CVE-2026-83536: Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.
Other sources
FIND-004 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).
http.Server{Addr: ..., Handler: mux, ErrorLog: ...} in main.go (lines 73-84) is constructed without ReadHeaderTimeout, ReadTimeout, WriteTimeout, or IdleTimeout. The promhttp handler's 2-second Timeout only starts after the request line and headers are fully parsed, so a client that trickles header bytes can hold a goroutine and file descriptor open indefinitely. Because the listener defaults to all interfaces (see FIND-003), an unauthenticated adjacent attacker can exhaust server FDs and block legitimate Prometheus scrapes. Flagged by gosec rule G112.
Attack pattern: Unauthenticated client opens many slow-header TCP connections to :1981, causing exporter file-descriptor exhaustion, which makes metrics scraping and alerting go blind.
Affected code: main.go:73-84
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium)
Remediation: Set ReadHeaderTimeout: 10time.Second, ReadTimeout: 30time.Second, WriteTimeout: 30time.Second, IdleTimeout: 60time.Second on the http.Server struct, or migrate to exporter-toolkit/web.ListenAndServe which applies sane defaults.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set ReadHeaderTimeout to 10*time.Second, ReadTimeout to 30*time.Second, WriteTimeout to 30*time.Second, and IdleTimeout to 60*time.Second on the http.Server struct.
openstack-network-exporter HTTP server ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout = ReadHeaderTimeout: 10*time.Second; ReadTimeout: 30*time.Second; WriteTimeout: 30*time.Second; IdleTimeout: 60*time.Second
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments whose exporter listener uses the default all-interfaces binding are exposed to unauthenticated adjacent attackers that can reach the HTTP service. The issue can disrupt Prometheus metric scraping and alerting by exhausting file descriptors.
What does an attacker need to exploit this?
The attacker needs network access to the exporter HTTP listener and does not need authentication or user interaction. They can open multiple connections and slowly trickle HTTP header bytes to keep connections open.
Does the promhttp 2-second timeout prevent this attack?
No. That timeout begins only after the request line and headers have been fully parsed, so it does not limit clients that slowly send headers.
How can I determine whether the deployed server configuration is affected?
Check whether the HTTP server is created without ReadHeaderTimeout, ReadTimeout, WriteTimeout, and IdleTimeout. The affected construction in main.go lines 73-84 configures Addr, Handler, and ErrorLog but omits those timeout settings.