CVE-2026-115638
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
OpenStack Ironic through version 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, also known as a gzip bomb.
Risk Assessment
An attacker could remotely cause resource exhaustion (CPU, memory, disk) by submitting a crafted configdrive, potentially leading to Ironic service unavailability and disruption of infrastructure provisioning.
Recommendation
Upgrade OpenStack Ironic to a version newer than 39.0.1 if available, or enforce limits on configdrive size and decompression depth, and monitor for abnormal resource consumption.
Other vulnerabilities in OpenStack Ironic
See all- CVE-2016-4985High
The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
- CVE-2026-90458Medium
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, for example to delete accounts from the BMC's Redfish service.
- CVE-2026-89419Medium
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident}, i.e., not using the specific maintenance endpoint.
- CVE-2026-90461Medium
OpenStack Ironic through version 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. Credentials may leak to an unintended recipient.
- CVE-2026-74250Medium
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
- CVE-2026-71201Medium
In OpenStack Ironic through 38.0.0, a project reader making a crafted request can return Portgroups assigned to Nodes owned or leased by another project.
- CVE-2026-54423High
In OpenStack Ironic before version 37.0.1, a user with the ability to deploy nodes via the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.
- CVE-2026-44918Medium
A vulnerability in OpenStack Ironic before version 37.0.1 allows unauthorized creation or modification of nodes across projects. Lack of proper authorization enables an attacker to manipulate resources without required permissions.
- CVE-2026-54421Medium
In OpenStack Ironic before version 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials).
- CVE-2026-50589Medium
In OpenStack Ironic versions 32 through 37.0.0, an unauthenticated user can submit a crafted JSON string to some API or JSON-RPC endpoints, causing a service crash.
Original NVD description (English source)
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS