What is the CVSS score of CVE-2026-44919?

CVE-2026-44919 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

OpenStack Ironic CVE-2026-44919

EUVD-2026-30209 MEDIUM

Incorrect Behavior Order (CWE-696)

2026-05-14 mitre

GHSA-4g73-w726-53h3

Denial Of Service Ironic

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jun 18, 2026 - 03:38 NVD

4.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 10:48 vuln.today

DescriptionNVD

In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

AnalysisAI

Infinite loop denial-of-service in OpenStack Ironic's image handling allows low-privileged authenticated attackers to exhaust conductor resources by supplying file:///dev/zero as an image URL, triggering unbounded checksum calculations that never terminate. All Ironic versions from 0 through 35.x prior to commit a3f6d73 are affected. No public exploit independently confirmed but SSVC data indicates proof-of-concept exists; EPSS sits at 0.01% (2nd percentile), consistent with low widespread exploitation likelihood despite the poc signal.

Technical ContextAI

OpenStack Ironic is the bare-metal provisioning service in the OpenStack ecosystem, responsible for deploying images to physical machines. CPE cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* covers all versions. During image handling, Ironic computes checksums to verify image integrity. The root cause is CWE-696 (Incorrect Behavior Order): the code attempts checksum computation before validating or sanitizing the supplied image URL. On Linux systems, /dev/zero is a pseudo-device that returns an infinite stream of null bytes when read. Providing file:///dev/zero causes the checksum function to read from this device indefinitely, never reaching an EOF that would terminate the loop. This design flaw - processing before input validation - is the architectural root cause rather than a simple bounds-check failure.

RemediationAI

The upstream fix is available at commit a3f6d735ac3642ab95b49142c7305f072ae748d0 (https://opendev.org/openstack/ironic/commit/a3f6d735ac3642ab95b49142c7305f072ae748d0); operators should apply this commit or upgrade to a downstream distribution package that includes it. The corresponding OpenStack Security Advisory OSSA-2026-013 (https://security.openstack.org/ossa/OSSA-2026-013.html) should be reviewed for specific release guidance. Note: a tagged patched release version has not been independently confirmed from available data - only the upstream commit is verified; confirm with your distribution or OpenStack release channel before deploying. As a compensating control pending patch application, restrict Ironic API access to only trusted operators and service accounts, reducing the pool of principals able to submit crafted image URLs. Additionally, consider deploying an API gateway or input-validation layer that blocks or rejects image URLs using the file:// scheme at the request boundary. The trade-off of the URL-scheme blocking approach is that it may break legitimate local image workflows if any are in use in your environment - audit your image sources before enforcing this restriction.