CYBERSECURITYTRACKER
Permanent story citation

[OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11800

As cited

Copy frozen at (site build).

vulnerabilities

[OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

OpenStack Ironic versions 16.2.0 through 39.0.1 (with specific ranges listed) contain a denial of service vulnerability in the Conductor component. An attacker can exploit this by supplying a gzip bomb within a configdrive to cause a denial of service.

Why it matters: Operators running vulnerable Ironic versions should patch immediately to prevent attackers from disrupting bare metal provisioning operations through specially crafted configdrives.

CVEsCVE-2026-115638
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary