Live › vulnerability › CVE-2026-115638
Go to dashboardOpenStack Ironic through 39.0.1 accepts a configdrive that expands into a very large amount of uncompressed data (a gzip bomb). An attacker who can supply a configdrive can make the service consume excessive resources and deny service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running OpenStack Ironic up to and including 39.0.1 where configdrive data can be supplied to the service. Deployments that do not accept configdrive input from untrusted parties are less exposed. Sources do not describe the exact trigger path further.
No product ranges from the sources yet.
ironic-api --version or the package manager, and compare against the versions named in the advisory39.0.1 to a release that includes the fix (exact fixed version: unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
This page as .md · .json · in your agent: get_signal("CVE-2026-115638")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.