OpenStack Ironic conductor DoS via gzip-bomb configdrive
OSSA-2026-049 assigns CVE-2026-115638 and lists Ironic lines from 16.2.0 through builds before 39.0.1.
48
Vulnerability1 · 1 read
CVE-2026-115638
Gzip-bomb DoS in OpenStack Ironic configdrive through 39.0.1
- CVSS 3.1
- 4.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
OpenStack Ironic through 39.0.1 can be driven into a denial of service when a configdrive expands to a very large amount of uncompressed data (a gzip bomb). A remote attacker with low privileges can trigger this over the network without user interaction. Impact is limited to availability of the Ironic conductor. Operators running Ironic at or below 39.0.1 are affected.
What to do: Apply OpenStack’s update for CVE-2026-115638 (OSSA-2026-049). No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| OpenStack Ironic | through 39.0.1 |
Estimated exposure
nicheunknown; limited to Ironic deployments — Ironic is an OpenStack bare-metal service; attack needs a low-privilege network account.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
- Weakness
- CWE-409
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L