Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-115638

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OpenStack Ironic

Default version status: unaffected

  • 30.0.0 to ≤ 32.1.1affected
  • 33.0.0 to ≤ 35.1.1affected
  • 36.0.0 to ≤ 39.0.1affected

References