CVE-2026-83536: Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.
Other sources
FIND-004 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).
http.Server{Addr: ..., Handler: mux, ErrorLog: ...} in main.go (lines 73-84) is constructed without ReadHeaderTimeout, ReadTimeout, WriteTimeout, or IdleTimeout. The promhttp handler's 2-second Timeout only starts after the request line and headers are fully parsed, so a client that trickles header bytes can hold a goroutine and file descriptor open indefinitely. Because the listener defaults to all interfaces (see FIND-003), an unauthenticated adjacent attacker can exhaust server FDs and block legitimate Prometheus scrapes. Flagged by gosec rule G112.
Attack pattern: Unauthenticated client opens many slow-header TCP connections to :1981, causing exporter file-descriptor exhaustion, which makes metrics scraping and alerting go blind.
Affected code: main.go:73-84
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium)
Remediation: Set ReadHeaderTimeout: 10time.Second, ReadTimeout: 30time.Second, WriteTimeout: 30time.Second, IdleTimeout: 60time.Second on the http.Server struct, or migrate to exporter-toolkit/web.ListenAndServe which applies sane defaults.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set ReadHeaderTimeout to 10*time.Second, ReadTimeout to 30*time.Second, WriteTimeout to 30*time.Second, and IdleTimeout to 60*time.Second on the http.Server struct.
openstack-network-exporter HTTP server ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout = ReadHeaderTimeout: 10*time.Second; ReadTimeout: 30*time.Second; WriteTimeout: 30*time.Second; IdleTimeout: 60*time.Second