OpenStack Ironic conductor DoS via gzip-bomb configdrive
Original title: [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)
OSSA-2026-049 assigns CVE-2026-115638 and lists Ironic lines from 16.2.0 through builds before 39.0.1.
Jay Faulkner posted OpenStack advisory OSSA-2026-049 on October 29, 2026. It describes an Ironic conductor denial of service through a gzip-bomb configdrive and assigns CVE-2026-115638. The affect list reads >=16.2.0, =30.0.0, =33.0.0, =36.0.0 and <39.0.1. The description says Jay Faulkner of G-Research Open Source Software reported the issue, then the feed snippet ends.
Unconfirmed: The snippet cuts off before technical details and any explicit fixed releases for each affected line.
- The advisory date is October 29, 2026.
- CVE-2026-115638 is the assigned identifier.
- Ironic versions are listed as >=16.2.0, =30.0.0, =33.0.0, =36.0.0 and <39.0.1.
- No exploitation status is included in the visible text.
Impact: Denial of service against the Ironic conductor
| Product | Affected |
|---|---|
| OpenStack Ironic | >=16.2.0 =30.0.0 =33.0.0 =36.0.0 <39.0.1 |
- CVEs
- CVE-2026-115638
- Vendors
- OpenStack
- Products
- Ironic
- Organizations
- G-Research
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115638 | Gzip-bomb DoS in OpenStack Ironic configdrive through 39.0.1 | 4.3 | — |
From the original article
Posted by Jay Faulkner on Oct 29 ============================================================= OSSA-2026-049: Ironic Conductor DoS via gzip bomb configdrive ============================================================= :Date: October 29, 2026 :CVE: CVE-2026-115638 Affects ~~~~~~~ - Ironic: >=16. 2. 0 =30.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.