CVE-2026-115638: Medium severity Openstack Ironic vulnerability
Published Oct 23, 2026
·Updated
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
Affected Software
1 affected component
Openstack Ironic<=39.0.1
Event History
Oct 23, 2026
CVE Published
via MITRE·03:21 AM
Data Sourced
via MITRE·03:21 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access and network reachability. No user interaction is required.
2
What is the practical impact?
A crafted configdrive containing a gzip bomb can expand to a very large amount of uncompressed data, causing a denial of service. The provided impact assessment indicates availability impact only, with no stated confidentiality or integrity impact.
3
Which versions are known to be affected?
OpenStack Ironic through version 39.0.1 is affected.