In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Openstack
  • Ironic

No data.

No data.

References
Link Providers
https://bugs.launchpad.net/ironic/+bug/2150332 cve-icon cve-icon
https://opendev.org/openstack/ironic/commit/a3f6d735ac3642ab95b49142c7305f072ae748d0 cve-icon cve-icon
History

Thu, 14 May 2026 03:45:00 +0000

Type Values Removed Values Added
Title Infinite Loop in Checksum Calculations via /dev/zero URL in OpenStack Ironic Image Handling

Thu, 14 May 2026 02:15:00 +0000

Type Values Removed Values Added
Description In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
First Time appeared Openstack
Openstack ironic
Weaknesses CWE-696
CPEs cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack ironic
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-05-14T00:00:00.000Z

Updated: 2026-05-14T01:31:10.186Z

Reserved: 2026-05-08T00:00:00.000Z

Link: CVE-2026-44919

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-14T02:17:21.773

Modified: 2026-05-14T02:17:21.773

Link: CVE-2026-44919

cve-icon Redhat

No data.