CVE-2026-115638 OpenStack CVE debrief

Who should care

Defenders responsible for OpenStack Ironic deployments should assess exposure and prioritize verification and updates to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-115638 is a medium-severity vulnerability in OpenStack Ironic that allows a denial-of-service attack via a configdrive with a large amount of uncompressed data. Defenders responsible for OpenStack Ironic deployments should assess exposure and prioritize verification and updates to prevent potential denial-of-service attacks.

• Denial-of-service attacks via configdrive
• Potential for resource exhaustion
• Need for verification and updates

Technical summary

OpenStack Ironic through 39.0.1 is vulnerable to a denial-of-service attack via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb. This vulnerability affects OpenStack Ironic deployments and allows attackers to potentially cause denial-of-service attacks. The issue is related to the handling of configdrive data and has a medium severity. Defenders should prioritize verifying and updating OpenStack Ironic deployments to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying and updating OpenStack Ironic deployments to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify OpenStack Ironic version and update to a non-affected version if necessary
• Review and limit configdrive size to prevent potential denial-of-service attacks
• Monitor OpenStack Ironic deployments for unusual activity

Evidence notes

The CVE record and source item provide information on the vulnerability, but details on exploitation and impact are limited. The CVE record was published on 2026-10-23T03:21:17.303Z and has not been modified since then. The source item provides CVE-2026-115638 details. However, additional verification is required to understand the full scope of the vulnerability and its potential impact on OpenStack Ironic deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.