Ironic (>=16.2.0 <29.1.1, >=30.0.0 <32.1.1, >=33.0.0 <35.1.1, >=36.0.0 <39.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ironic-16.2.0-29.1.1-30.0.0-32.1.1-33.0.0-35.1.1-36.0.0-39.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 15:29:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenStack Ironic: Conductor denial-of-service via gzip bomb (CVE-2026-115638)https://feed.craftedsignal.io/briefs/2026-10-ironic-dos/Thu, 29 Oct 2026 15:29:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ironic-dos/The OpenStack Ironic Conductor service is vulnerable to a denial-of-service attack due to improper handling of maliciously crafted compressed configuration drive files.A vulnerability (CVE-2026-115638) exists in the OpenStack Ironic Conductor service where processing a specifically crafted 'gzip bomb' within a configdrive can cause excessive resource consumption. This leads to instability or failure of the conductor service. The vulnerability affects multiple versions of Ironic as specified in the OSSA-2026-049 advisory.

Impact

Successful exploitation allows an attacker to trigger a denial-of-service condition on the Ironic Conductor, potentially disrupting bare metal provisioning and management operations.

Recommendation

  • Update OpenStack Ironic to the patched versions as recommended in OSSA-2026-049:
  • Upgrade 16.2.x series to >= 29.1.1
  • Upgrade 30.0.x series to >= 32.1.1
  • Upgrade 33.0.x series to >= 35.1.1
  • Upgrade 36.0.x series to >= 39.0.1
  • Monitor Ironic Conductor logs for unexpected process crashes, memory exhaustion errors, or high CPU utilization during configuration drive submission tasks.
]]>lowadvisorydenial-of-servicecloudopenstack