{"id":"CVE-2026-115638","kind":"vulnerability","aliases":["CVE-2026-115638"],"related":[],"title":"OpenStack Ironic: crafted configdrive gzip bomb can exhaust server resources","description":"OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.","summary":"OpenStack Ironic through 39.0.1 accepts a configdrive that expands into a very large amount of uncompressed data (a gzip bomb). An attacker who can supply a configdrive can make the service consume excessive resources and deny service.","severity":"medium","cvss":4.3,"epss":0.00212,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bare-metal","infrastructure","ironic","openstack","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Ironic version with `ironic-api --version` or the package manager, and compare against the versions named in the advisory\n- Confirm whether configdrive images from untrusted sources are accepted by your Ironic deployment (unknown from sources)","fix":"- Upgrade OpenStack Ironic past `39.0.1` to a release that includes the fix (exact fixed version: unknown from sources)","status":"open","published_at":"2026-10-23T04:18:16+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:37:21+00:00","updated_at":"2026-10-25T04:37:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:37:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenStack Ironic past `39.0.1` to a release that includes the fix (exact fixed version: unknown from sources)","reach":"unknown","title":"OpenStack Ironic: crafted configdrive gzip bomb can exhaust server resources","impact":"low","summary":"OpenStack Ironic through 39.0.1 accepts a configdrive that expands into a very large amount of uncompressed data (a gzip bomb). An attacker who can supply a configdrive can make the service consume excessive resources and deny service.","category":"infrastructure","nicknames":[],"who_cares":["openstack","ironic","self-hosted","bare-metal"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Service resource exhaustion causes denial of service for Ironic","analyst_note":"Confirm the fixed Ironic version and whether the configdrive path requires authenticated API access, via the NVD entry linked in the sources.","how_to_check":"- Check the installed Ironic version with `ironic-api --version` or the package manager, and compare against the versions named in the advisory\n- Confirm whether configdrive images from untrusted sources are accepted by your Ironic deployment (unknown from sources)","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Operators running OpenStack Ironic up to and including 39.0.1 where configdrive data can be supplied to the service. Deployments that do not accept configdrive input from untrusted parties are less exposed. Sources do not describe the exact trigger path further.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3316,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115638':13A,16A '-2026':12A,15A '39.0.1':29B,66C 'accept':30B 'aka':85C 'allow':67C 'amount':39B,81C 'attack':47B 'bare':18B 'bare-met':17B 'bomb':6A,45B,88C 'configdr':4A,32B,52B,74C 'consum':57B 'craft':3A 'cve':11A,14A 'data':42B,84C 'deni':61B 'denial':69C 'excess':58B 'exhaust':8A 'expand':34B 'gzip':5A,44B,87C 'host':25B 'infrastructur':20B 'iron':2A,21B,27B,64C 'larg':38B,80C 'make':54B 'metal':19B 'openstack':1A,22B,26B,63C 'resourc':10A,59B 'result':76C 'self':24B 'self-host':23B 'server':9A 'servic':56B,62B,71C 'suppli':50B 'uncompress':41B,83C 'via':72C","nicknames":[],"mitigations":[],"who_affected":"Operators running OpenStack Ironic up to and including 39.0.1 where configdrive data can be supplied to the service. Deployments that do not accept configdrive input from untrusted parties are less exposed. Sources do not describe the exact trigger path further.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T04:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115638","severity":null,"published_at":"2026-10-23T04:18:16+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115638","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115638","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}