PT-2026-121742
CVE-2026-115638
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions
OpenStack Ironic versions prior to 39.0.2
Description
An issue exists where a configdrive can be used to trigger a denial of service. This occurs when the system processes a gzip bomb, which is a highly compressed archive that expands into an extremely large amount of uncompressed data upon extraction, exhausting system resources.
Recommendations
Update OpenStack Ironic to version 39.0.2 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾