REDHAT-BUG-2526401: Medium severity Openstack openstack-network-exporter vulnerability
FIND-004 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).
http.Server{Addr: ..., Handler: mux, ErrorLog: ...} in main.go (lines 73-84) is constructed without ReadHeaderTimeout, ReadTimeout, WriteTimeout, or IdleTimeout. The promhttp handler's 2-second Timeout only starts after the request line and headers are fully parsed, so a client that trickles header bytes can hold a goroutine and file descriptor open indefinitely. Because the listener defaults to all interfaces (see FIND-003), an unauthenticated adjacent attacker can exhaust server FDs and block legitimate Prometheus scrapes. Flagged by gosec rule G112.
Attack pattern: Unauthenticated client opens many slow-header TCP connections to :1981, causing exporter file-descriptor exhaustion, which makes metrics scraping and alerting go blind.
Affected code: main.go:73-84
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium)
Remediation: Set ReadHeaderTimeout: 10time.Second, ReadTimeout: 30time.Second, WriteTimeout: 30time.Second, IdleTimeout: 60time.Second on the http.Server struct, or migrate to exporter-toolkit/web.ListenAndServe which applies sane defaults.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set ReadHeaderTimeout to 10*time.Second, ReadTimeout to 30*time.Second, WriteTimeout to 30*time.Second, and IdleTimeout to 60*time.Second on the http.Server struct.
Go http.Server ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout = ReadHeaderTimeout: 10*time.Second; ReadTimeout: 30*time.Second; WriteTimeout: 30*time.Second; IdleTimeout: 60*time.Second - Configuration
Migrate from the directly constructed http.Server to exporter-toolkit/web.ListenAndServe, which applies sane defaults.
HTTP server listener server implementation = exporter-toolkit/web.ListenAndServe