In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation poc

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
OpenStack Ironic unaffected
Version Status Constraints
23.0.4 affected < 29.0.6
30.0.0 affected < 32.0.2
33.0.0 affected < 35.0.2

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Openstack Subscribe
Ironic Subscribe

Project Subscriptions

Vendors Products
Openstack Subscribe
Ironic Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4g73-w726-53h3 OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://bugs.launchpad.net/ironic/+bug/2150332 cve-icon cve-icon cve-icon
https://opendev.org/openstack/ironic/commit/a3f6d735ac3642ab95b49142c7305f072ae748d0 cve-icon cve-icon
https://security.openstack.org/ossa/OSSA-2026-013.html cve-icon cve-icon
History

Wed, 20 May 2026 16:45:00 +0000

Type Values Removed Values Added
References

Thu, 14 May 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 14 May 2026 03:45:00 +0000

Type Values Removed Values Added
Title Infinite Loop in Checksum Calculations via /dev/zero URL in OpenStack Ironic Image Handling

Thu, 14 May 2026 02:15:00 +0000

Type Values Removed Values Added
Description In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
First Time appeared Openstack
Openstack ironic
Weaknesses CWE-696
CPEs cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack ironic
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-05-21T06:16:30.581Z

Reserved: 2026-05-08T00:00:00.000Z

Link: CVE-2026-44919

cve-icon Vulnrichment

Updated: 2026-05-14T13:53:21.400Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-14T02:17:21.773

Modified: 2026-05-20T17:16:23.870

Link: CVE-2026-44919

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-14T03:30:10Z

Weaknesses