EUVD-2026-108570
GHSA-48wg-78rx-fcjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Ironic provisioning API
-
ExploitSubmit crafted gzip-bomb configdrive
-
ExecutionService decompresses amplified data
-
ImpactExhaust disk/memory causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Exploitation requires an authenticated actor with the ability to submit a configdrive to Ironic (for example during node provisioning or rebuild), consistent with PR:L in the CVSS vector; the attacker supplies a configdrive whose compressed content decompresses to a very large uncompressed size. The main limiting factors are that authentication/provisioning privileges are needed (not an anonymous remote attacker) and the impact is confined to availability (resource exhaustion) with no confidentiality or integrity effect. The description does not state a non-default configuration requirement beyond the ability to provide a configdrive, so the precise processing path that triggers amplification is not further detailed in the available sources. |
| Impact | This is a moderate-severity, availability-only issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) describes a network-reachable but authenticated (PR:L) attack with no confidentiality or integrity impact and only limited availability impact - characteristic of a resource-exhaustion denial of service rather than a system-compromise bug, matching CWE-409 (data amplification / decompression bomb). No EPSS score was supplied, the CVE is not on CISA KEV, and the single reference is a Launchpad bug report rather than published exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with a low-to-moderate, authentication-gated DoS. Net: this is a real but non-urgent hardening priority - patch on a normal maintenance cadence; it is not a high-CVSS-but-illusory issue, nor is it an emergency. Note that no fixed version is stated in the available evidence, so remediation timing must be confirmed with the Ironic project. |
| Exploit ScenarioDerived | An authenticated user able to provision or reconfigure a node supplies a configdrive whose gzip-compressed payload expands to a very large amount of uncompressed data (a gzip bomb). When Ironic decompresses and processes it, disk and/or memory are exhausted, degrading or denying service on the affected node/conductor. No public exploit code was identified; the only reference is an upstream bug report. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
Authenticated users who can submit a configdrive to OpenStack Ironic can cause resource exhaustion by supplying highly compressed data that expands to a very large uncompressed size, reducing availability of the provisioning service. Ironic through 39.0.1 is affected, and the issue is scored 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), so impact is limited to availability and requires provisioning-level access. No public exploit code or confirmed active exploitation was identified in the available data.
RemediationAI
No fixed release is listed in the available data, so the primary action is to monitor the Launchpad advisory at https://bugs.launchpad.net/ironic/+bug/2171814 for a patched release and upgrade to a version that the advisory identifies as fixed. Where an upgrade is not yet available, limit configdrive submission to trusted provisioning operators and enforce decompressed-size or resource limits on configdrive handling; these controls reduce exposure but do not fix the root cause and may reject legitimate large configdrives or add provisioning friction. Because the CVSS vector is PR:L, the exposure is limited to authenticated actors, so reviewing which roles can trigger provisioning or rebuild with a supplied configdrive is directly relevant.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ironic is OpenStack's bare-metal provisioning service. A configdrive is a metadata payload attached to a node during provisioning or rebuild; when it is gzip-compressed, Ironic decompresses it to read the contents. CWE-409 describes improper handling of highly compressed data, and in this case the decompression is not bounded to a safe uncompressed size, so a small compressed payload can expand to very large data and consume memory, disk, or CPU. The provided sources do not identify the exact code path, service process, or whether specific deployment configurations or configdrive formats are required; the assessed precondition is an authenticated actor able to submit a configdrive, consistent with PR:L in the CVSS vector. No additional race, timing, or attacker-uncontrolled condition is described in the available sources.
Know when Openstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable API but requires an authenticated user who can submit a configdrive, so PR:L; impact is resource-exhaustion DoS only, giving C:N/I:N/A:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Exploit-DB