REDHAT-BUG-2526401: Medium severity Openstack openstack-network-exporter vulnerability
FIND-004 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).
http.Server{Addr: ..., Handler: mux, ErrorLog: ...} in main.go (lines 73-84) is constructed without ReadHeaderTimeout, ReadTimeout, WriteTimeout, or IdleTimeout. The promhttp handler's 2-second Timeout only starts after the request line and headers are fully parsed, so a client that trickles header bytes can hold a goroutine and file descriptor open indefinitely. Because the listener defaults to all interfaces (see FIND-003), an unauthenticated adjacent attacker can exhaust server FDs and block legitimate Prometheus scrapes. Flagged by gosec rule G112.
Attack pattern: Unauthenticated client opens many slow-header TCP connections to :1981, causing exporter file-descriptor exhaustion, which makes metrics scraping and alerting go blind.
Affected code: main.go:73-84
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium)
Remediation: Set ReadHeaderTimeout: 10time.Second, ReadTimeout: 30time.Second, WriteTimeout: 30time.Second, IdleTimeout: 60time.Second on the http.Server struct, or migrate to exporter-toolkit/web.ListenAndServe which applies sane defaults.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set ReadHeaderTimeout to 10*time.Second, ReadTimeout to 30*time.Second, WriteTimeout to 30*time.Second, and IdleTimeout to 60*time.Second on the http.Server struct.
Go http.Server ReadHeaderTimeout, ReadTimeout, WriteTimeout, IdleTimeout = ReadHeaderTimeout: 10*time.Second; ReadTimeout: 30*time.Second; WriteTimeout: 30*time.Second; IdleTimeout: 60*time.Second - Configuration
Migrate from the directly constructed http.Server to exporter-toolkit/web.ListenAndServe, which applies sane defaults.
HTTP server listener server implementation = exporter-toolkit/web.ListenAndServe
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with adjacent network access to the exporter can exploit it. The listener defaults to all interfaces, increasing exposure where port 1981 is reachable.
What does an attacker need to do?
The attacker opens many TCP connections to port 1981 and slowly trickles request-header bytes. This keeps connections open before the promhttp handler's 2-second timeout begins.
Are default deployments exposed?
The listener defaults to all interfaces, so deployments may be reachable beyond localhost unless network controls restrict access to port 1981. The affected server construction has no read-header, read, write, or idle timeouts.
What can be changed if a patch is not immediately available?
Configure the HTTP server with ReadHeaderTimeout of 10 seconds, ReadTimeout of 30 seconds, WriteTimeout of 30 seconds, and IdleTimeout of 60 seconds. Restricting network access to port 1981 can also reduce exposure to adjacent attackers.