CVE-2026-44919: Infinite Loop in OpenStack Ironic

An attacker could exploit this vulnerability by crafting a malicious image request using the file:///dev/zero URL. This triggers the infinite loop in the checksum calculation process, consuming excessive CPU resources and potentially crashing the Ironic service. The impact is primarily a denial of service, preventing legitimate users from provisioning or managing virtual machines. While direct data exfiltration is unlikely, the disruption of Ironic services can significantly impact cloud infrastructure operations. The blast radius extends to any service dependent on Ironic for instance provisioning, potentially affecting a wide range of applications and users within the cloud environment.

1. Reserviert2026-05-08
2. Veröffentlicht2026-05-14

The primary mitigation for CVE-2026-44919 is to upgrade OpenStack Ironic to version a3f6d735ac3642ab95b49142c7305f072ae748d0 or later. Prior to upgrading, review the release notes for any potential breaking changes and plan a rollback strategy if necessary. As a temporary workaround, consider implementing input validation to reject requests containing the file:///dev/zero URL. While not a complete solution, this can reduce the attack surface. Monitor Ironic service resource utilization (CPU, memory) for unusual spikes, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to process an image using the vulnerable URL and verifying that the checksum calculation completes without entering an infinite loop.