Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OpenStack | Ironic | unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Openstack | Ironic | 95% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://bugs.launchpad.net/ironic/+bug/2171814 |
|
Fri, 23 Oct 2026 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Denial of Service via Configdrive Gzip Bomb in OpenStack Ironic ≤ 39.0.1 |
Fri, 23 Oct 2026 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb. | |
| First Time appeared |
Openstack
Openstack ironic |
|
| Weaknesses | CWE-409 | |
| CPEs | cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Openstack
Openstack ironic |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-10-23T03:21:17.303Z
Reserved: 2026-10-23T03:21:16.440Z
Link: CVE-2026-115638
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-23T04:18:16.180
Modified: 2026-10-23T04:18:16.180
Link: CVE-2026-115638
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-23T06:00:12Z
-
CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)