EUVD-2026-34774
GHSA-q3g8-rjrx-59ph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Ironic API or JSON-RPC endpoint
-
DeliveryCraft malicious JSON payload
-
ExploitSend unauthenticated request to vulnerable endpoint
-
ExecutionTrigger unbounded resource consumption (CWE-770)
-
PersistCrash Ironic service process
-
ImpactDisrupt bare-metal provisioning availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to either the Ironic REST API or the JSON-RPC service on an OpenStack deployment running Ironic version 32 through 35.0.1, and the ability to submit a crafted JSON body to one of the affected endpoints; no authentication, user interaction, or non-default configuration is needed per CVSS AV:N/AC:L/PR:N/UI:N. The principal limiting factor is network exposure: in deployments where the Ironic API and JSON-RPC ports are bound to a management network and not reachable from tenant or internet-facing networks, an external attacker cannot reach the vulnerable endpoints, and the population of realistically exploitable installations is restricted to those with misconfigured segmentation or intentional public exposure. Impact is limited to availability - there is no confidentiality or integrity effect - so the condition for damage is simply repeated payload delivery to keep the daemon crashed. |
| Impact | Signals diverge meaningfully here: CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) frames this as a high-severity remotely reachable DoS, and SSVC flags it as automatable with partial technical impact, both of which argue for prompt patching in environments where the Ironic API or JSON-RPC port is reachable by untrusted networks. Counterbalancing that, EPSS is just 0.04% at the 12th percentile, SSVC exploitation is 'none', this CVE is not on the CISA KEV list, and no public exploit code is identified - so real-world exploitation pressure is currently low. The practical risk concentrates in deployments that expose Ironic endpoints beyond the management network; in well-segmented OpenStack control planes the blast radius is much smaller than the raw CVSS suggests. No data conflicts were observed beyond the typical CVSS-vs-EPSS gap common to DoS bugs. |
| Exploit ScenarioDerived | An attacker with network reachability to the Ironic API or JSON-RPC port sends a single crafted JSON request to a vulnerable endpoint without authenticating, causing the Ironic service process to crash and halting bare-metal provisioning and node management until the daemon is restarted. Repeated submissions can keep the service unavailable, disrupting tenant deployments and any automation that depends on Ironic. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated vector make a working PoC straightforward to develop once the specific payload shape is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 16, 2026
Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows remote unauthenticated attackers to crash the bare-metal provisioning service by submitting a crafted JSON payload to certain API or JSON-RPC endpoints. CVSS 7.5 reflects high availability impact with no authentication required, though EPSS is only 0.04% (12th percentile) and SSVC marks exploitation as 'none' - no public exploit identified at time of analysis. The flaw is tracked as a CWE-770 unbounded resource consumption issue and documented in OpenStack Security Note OSSN-0099.
Earlier versions of this analysis (2)
Denial of service in OpenStack Ironic versions 32 through 35.0.1 allows unauthenticated remote attackers to crash the bare-metal provisioning service by submitting a malformed JSON payload to exposed API or JSON-RPC endpoints. No public exploit identified at time of analysis, but the SSVC framework rates the issue as automatable, and EPSS remains low at 0.04%. Impact is availability-only (no data exposure), but Ironic outages directly halt bare-metal node provisioning and lifecycle management in affected OpenStack clouds.
OpenStack Ironic versions 32 through 35.0.1 expose unauthenticated remote attackers to a denial-of-service condition via crafted JSON payloads submitted to the API or JSON-RPC service endpoints. The flaw (CWE-770) reflects insufficient resource allocation controls, meaning no authentication, elevated privileges, or user interaction are required to crash the service. No public exploit code has been identified at time of analysis, but the zero-complexity, zero-privilege attack profile makes this a practical threat against any network-reachable Ironic deployment.
RemediationAI
Upstream fix available per OSSN-0099 and the Launchpad bug; a released patched version is not independently confirmed from the input data, so operators should consult OSSN-0099 (https://wiki.openstack.org/wiki/OSSN/OSSN-0099) and the Ironic stable branch advisories to identify the specific 35.0.x or later point release that contains the fix and upgrade accordingly. Until upgraded, restrict network exposure of both the Ironic API endpoint and the JSON-RPC service to the management/control-plane network only via firewall or security-group rules - this is the highest-value compensating control because the bug is unauthenticated and remotely reachable, with the trade-off that any tooling reaching Ironic from outside that segment will need to be re-homed. Additional defenses include placing a reverse proxy or WAF in front of the Ironic API to enforce JSON size and structural limits and rate-limit per source IP, which mitigates resource-exhaustion payloads but adds an operational component and may break very large legitimate requests. Monitor the oss-security thread (https://seclists.org/oss-sec/2026/q2/823 and http://www.openwall.com/lists/oss-security/2026/06/06/2) for the confirmed fix tag.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenStack Ironic is the bare-metal provisioning service within OpenStack, exposing a REST API and a JSON-RPC interface that conductors and API workers use to coordinate node management. CPE cpe:2.3:a:openstack:ironic covers versions 32 through 35.0.1 of the upstream component. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the JSON parsing or request-handling path in some endpoints does not bound the resources consumed when processing attacker-controlled JSON, allowing a single crafted payload to exhaust memory, CPU, or worker threads and crash the daemon. OSSN-0099 and the Launchpad bug 2154288 are the authoritative upstream references.
Know when Openstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote JSON payload crashes the service with no user interaction, no confidentiality or integrity impact, only high availability impact.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
In OpenStack Ironic 32 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
Executive ViewAI
OpenStack Ironic bare-metal provisioning service (versions 32-35.0.1) is vulnerable to unauthenticated denial-of-service attacks via crafted JSON payloads, which crash the provisioning service and halt infrastructure deployments. Although exploitation probability is very low (0.04% EPSS), the high availability impact combined with the absence of an available patch requires immediate defensive measures. Organizations running affected versions should restrict API access and implement monitoring while awaiting vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to Ironic API and JSON-RPC endpoints to authorized sources via firewall rules; (2) implement request rate limiting and payload size restrictions to mitigate resource exhaustion attacks; (3) enable detailed API request logging and alerting for malformed or oversized JSON submissions; (4) segment bare-metal provisioning infrastructure from general network to limit blast radius; (5) maintain updated system inventory to enable rapid remediation upon patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Exploit-DB