EUVD-2026-27406
GHSA-vxvf-xvm3-p8j5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.
AnalysisAI
OpenStack Horizon 25.6 and 25.7 before 25.7.3 allows unauthenticated remote attackers to exhaust session storage backend resources through repeated requests that trigger write operations prior to authentication, causing denial of service. This is a regression of CVE-2014-8124 and is assigned CVSS 5.3 (network-based, low complexity, no authentication required).
Technical ContextAI
OpenStack Horizon is the web-based management dashboard for OpenStack cloud infrastructure. The vulnerability stems from a session management flaw (CWE-696: Incorrect Behavior Order) where the application writes session data to the backend storage layer before validating user credentials. Session storage backends (typically Redis, Memcached, or database) have finite capacity; an attacker can craft rapid unauthenticated requests that each create a session entry, exhausting available storage space and rendering the dashboard unavailable to legitimate users. This reintroduces a design flaw previously patched in CVE-2014-8124, indicating a regression in code that was later modified.
RemediationAI
Upgrade OpenStack Horizon to version 25.7.3 or later immediately. For Horizon 25.6 users, upgrade to the next stable release series (26.0 or later when available). If immediate patching is not feasible, implement rate limiting at the reverse proxy or load balancer layer (e.g., nginx rate_limit, HAProxy stick-table) to restrict unauthenticated requests per IP address to a low threshold (e.g., 10 requests per 10 seconds), and monitor session storage backend usage for rapid growth indicating ongoing attacks. Additionally, configure session backend storage with appropriate size limits and eviction policies (LRU or TTL-based) to prevent complete exhaustion. These mitigations reduce but do not eliminate risk; patching is strongly recommended.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same weakness CWE-696 – Incorrect Behavior Order
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today