EUVD-2026-37218
GHSA-mfg3-p6m3-gjgr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Network API reachable (AV:N) with low complexity, exploitable by an ordinary authenticated tenant (PR:L); broken cross-service resource accounting (S:C, I:L) enables host resource exhaustion (A:H) with no confidentiality impact.
Primary rating from Vendor (CNA).
CVSS VectorNVD
Lifecycle Timeline
8Description PRE-NVD
AnalysisAI
Resource-accounting bypass in OpenStack Nova (compute service) lets an authenticated tenant create an instance whose scheduler hint data is not properly stripped, resulting in a running VM that has no corresponding Placement allocation. Because the instance consumes real host CPU/RAM/disk that the Placement service never accounted for, an attacker with ordinary project credentials can quietly over-subscribe a compute host and degrade availability for co-located tenants. SSVC lists exploitation as proof-of-concept (no public exploit identified as weaponized) with partial technical impact; EPSS is low at 0.26% (17th percentile).
Technical ContextAI
OpenStack Nova is the compute orchestration service that provisions and manages virtual machine instances across a fleet of hypervisor hosts, relying on the Placement API as the authoritative inventory/accounting service that tracks which resources (vCPU, memory, disk) each instance reserves. The flaw is classified as CWE-669 (Incorrect Resource Transfer Between Spheres): the server-create API path fails to sanitize/strip certain scheduler 'hint' data, so the instance is built and boots on a host but the corresponding Placement allocation record is never created. The affected component per CPE is cpe:2.3:a:openstack:nova across all listed versions, and the defect lives in the API-to-scheduler-to-Placement handoff rather than in the hypervisor itself.
RemediationAI
Upgrade Nova to a fixed release on your branch: Vendor-released patch 33.0.2 for the 33.x line, 32.2.1 for the 32.x line, and 31.3.1 for the 18.0.0-31.x range. Consult the upstream advisory (https://seclists.org/oss-sec/2026/q2/943 and the openwall posting at https://www.openwall.com/lists/oss-security/2026/06/16/5) and the Launchpad bug (https://bugs.launchpad.net/nova/+bug/2151252) for the exact backport for your deployment. If immediate patching is not possible, reduce exposure by restricting which projects/roles may pass scheduler hints (tighten policy on the server-create API and any custom RBAC granting hint usage), and audit for instances that exist in Nova but have no matching Placement allocation using the 'nova-manage placement' / 'nova-audit' tooling and Placement allocation reports, reconciling or deleting orphaned instances - the trade-off is that audit-and-reconcile is detective rather than preventive and does not stop new occurrences until the patch is applied. Lowering host allocation_ratio headroom can blunt the availability impact of over-subscription but reduces legitimate capacity.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today