CVE-2026-115638

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115638", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-23T03:21:16.440Z", "datePublished": "2026-10-23T03:21:17.303Z", "dateUpdated": "2026-10-29T17:05:16.854Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Ironic", "vendor": "OpenStack", "versions": [{"lessThanOrEqual": "32.1.1", "status": "affected", "version": "30.0.0", "versionType": "semver"}, {"lessThanOrEqual": "35.1.1", "status": "affected", "version": "33.0.0", "versionType": "semver"}, {"lessThanOrEqual": "39.0.1", "status": "affected", "version": "36.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-23T03:21:17.303Z"}, "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2171814"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "30.0.0", "versionEndIncluding": "32.1.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "33.0.0", "versionEndIncluding": "35.1.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "versionStartIncluding": "36.0.0", "versionEndIncluding": "39.0.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T17:48:19.615590Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T17:57:34.658Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/29/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T17:05:16.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/29/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T17:05:16.854Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115638", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T17:48:19.615590Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T17:50:29.103Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenStack", "product": "Ironic", "versions": [{"status": "affected", "version": "30.0.0", "versionType": "semver", "lessThanOrEqual": "32.1.1"}, {"status": "affected", "version": "33.0.0", "versionType": "semver", "lessThanOrEqual": "35.1.1"}, {"status": "affected", "version": "36.0.0", "versionType": "semver", "lessThanOrEqual": "39.0.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/ironic/+bug/2171814"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-409", "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "32.1.1", "versionStartIncluding": "30.0.0"}, {"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "35.1.1", "versionStartIncluding": "33.0.0"}, {"criteria": "cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "39.0.1", "versionStartIncluding": "36.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-23T03:21:17.303Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115638", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:05:16.854Z", "dateReserved": "2026-10-23T03:21:16.440Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-23T03:21:17.303Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ironic", "vendor": "OpenStack", "versions": [{"lessThanOrEqual": "32.1.1", "status": "affected", "version": "30.0.0", "versionType": "semver"}, {"lessThanOrEqual": "35.1.1", "status": "affected", "version": "33.0.0", "versionType": "semver"}, {"lessThanOrEqual": "39.0.1", "status": "affected", "version": "36.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb."}], "id": "CVE-2026-115638", "lastModified": "2026-10-29T17:18:01.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115638", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T17:48:19.615590Z", "version": "2.0.3"}}]}, "published": "2026-10-23T04:18:16.180", "references": [{"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/ironic/+bug/2171814"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/29/1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-409"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-ironic: openstack-ironic: Denial of Service via decompression bomb in configdrive", "id": "2559438", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559438"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-409", "details": ["OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.", "A flaw was found in OpenStack Ironic. An authenticated remote attacker can exploit this issue by supplying a specially crafted configuration drive containing compressed data that expands to an excessively large size. Processing this data can exhaust system memory and storage resources, leading to a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-115638", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "openstack-ironic", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-10-23T03:21:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115638\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115638\nhttps://bugs.launchpad.net/ironic/+bug/2171814"], "statement": "This vulnerability is evaluated as Moderate impact because exploitation requires authenticated credentials with permissions to trigger instance provisioning in OpenStack. Although an oversized or heavily compressed archive within a configuration drive can deplete storage or memory capacity on the bare metal conductor service, the issue cannot be leveraged for arbitrary code execution or data modification. In typical Red Hat OpenStack Platform deployments, access to bare metal provisioning is restricted to trusted operators or controlled tenants, limiting the overall blast radius.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[30.0.0,32.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[33.0.0,35.1.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[36.0.0,39.0.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Ironic", "source": "cna", "vendor": "OpenStack"}, "product": "ironic", "vendor": "openstack"}], "created": "2026-10-23T05:45:12.075721+00:00", "title": "Denial of Service via Configdrive Gzip Bomb in OpenStack Ironic \u2264 39.0.1", "updated": "2026-10-23T06:00:12.254192+00:00", "vendors": ["openstack", "openstack$PRODUCT$ironic"]}