OpenStack Network Exporter CVE-2026-83536

Exploitation requires that the openstack-network-exporter HTTP metrics server be network-reachable by the attacker; the component ships without a ReadHeaderTimeout (and related timeouts), so any default-configured, exposed instance is affected without authentication or user interaction. The practical limiting factor is network exposure: in typical deployments the exporter is reached only by Prometheus over a management/monitoring network, so risk hinges on whether that endpoint is segmented from untrusted hosts. Impact is confined to loss of metric scraping and alerting availability - it does not grant access to or disrupt the OpenStack data plane itself.

This is a genuine but modest-severity availability issue, best treated as routine hardening rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium) is internally consistent with the description: a remote, unauthenticated attacker exploits a missing ReadHeaderTimeout on the HTTP server to mount a Slowloris-style slow-header attack, with impact limited to availability (A:L) and no confidentiality or integrity loss. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' The technical impact is partial (metric scraping/alerting disruption, not full system compromise), and the affected component is an observability exporter rather than a control-plane service, which caps real-world consequence. One nuance to verify: A:L reflects that only the exporter's metrics endpoint goes down, not the underlying OpenStack workloads - the primary harm is a monitoring blind spot. Slowloris-class flaws are well understood and the technique is trivially automatable, so the low complexity (AC:L) is accurate, but absent any exploitation-probability data this should be prioritized by exposure (is the exporter reachable from untrusted networks?) rather than by raw score.

An attacker with network reachability to the openstack-network-exporter metrics endpoint opens many TCP connections and trickles HTTP header bytes very slowly, never completing a request. Because the server has no ReadHeaderTimeout, each connection is held open indefinitely, exhausting file descriptors until the exporter can no longer accept Prometheus scrapes. No public exploit is identified, but the Slowloris technique is trivial to reproduce with commodity tooling.