Skip to content
Threat Feed
Subscribe
low advisory

OpenStack Ironic: Conductor denial-of-service via gzip bomb (CVE-2026-115638)

The OpenStack Ironic Conductor service is vulnerable to a denial-of-service attack due to improper handling of maliciously crafted compressed configuration drive files.

CVE search metadata

CVE search record: CVE-2026-115638. Severity: medium. CVSS: 4.3. EPSS: 0.21%. KEV: no. Product: Ironic (>=16.2.0 <29.1.1, >=30.0.0 <32.1.1, >=33.0.0 <35.1.1, >=36.0.0 <39.0.1). Brief: OpenStack Ironic: Conductor denial-of-service via gzip bomb (CVE-2026-115638). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ironic-dos/

Triage facts

Revision 1
Applicability
Ironic (>=16.2.0 <29.1.1, >=30.0.0 <32.1.1, >=33.0.0 <35.1.1, >=36.0.0 <39.0.1)
Evidence
Unknown
Severity
Low
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 29, 15:29 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

A vulnerability (CVE-2026-115638) exists in the OpenStack Ironic Conductor service where processing a specifically crafted 'gzip bomb' within a configdrive can cause excessive resource consumption. This leads to instability or failure of the conductor service. The vulnerability affects multiple versions of Ironic as specified in the OSSA-2026-049 advisory.

Impact

Successful exploitation allows an attacker to trigger a denial-of-service condition on the Ironic Conductor, potentially disrupting bare metal provisioning and management operations.

Recommendation

  • Update OpenStack Ironic to the patched versions as recommended in OSSA-2026-049:
  • Upgrade 16.2.x series to >= 29.1.1
  • Upgrade 30.0.x series to >= 32.1.1
  • Upgrade 33.0.x series to >= 35.1.1
  • Upgrade 36.0.x series to >= 39.0.1
  • Monitor Ironic Conductor logs for unexpected process crashes, memory exhaustion errors, or high CPU utilization during configuration drive submission tasks.

Immediate actions

Patch OpenStack Ironic to the specified non-vulnerable versions.

IT Operations 72h

Threat Hunt

Identify Ironic Conductor service crashes or resource spikes associated with configdrive processing.

T1499.001 medium medium confidence hunt now

Data: Ironic Conductor service logs, System resource monitoring (CPU/RAM) for conductor hosts

Mitigations

Upgrade Ironic Conductor to patched versions listed in the brief.

immediate IT Operations

CVE-2026-115638