# CVE-2026-43002: OpenStack Horizon denial of service via session storage exhaustion

Source: https://junglewise.ai/threats/cve-2026-43002-openstack-horizon-denial-of-service-via-session-storage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-43002 · Severity: medium · CVSS 5.3 · Published 2026-05-05

A vulnerability in the OpenStack Horizon dashboard allows unauthenticated users to crash the service by flooding it with simple web requests. By repeatedly accessing the login page with a specific web parameter, an attacker can fill up the server's memory or database with temporary session data. This results in a denial-of-service where legitimate administrators are logged out and cannot regain access to manage their cloud infrastructure.

Technologies: [horizon (PyPI)](https://junglewise.ai/threats/technologies/horizon). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-43002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43002 being exploited in the wild.

**How severe is CVE-2026-43002?** Medium severity, with a CVSS score of 5.3, published 5 May 2026.

**Which products and versions are affected?** horizon (PyPI) ECOSYSTEM:introduced=25.6,fixed=25.7.3.

**Is there a fix for CVE-2026-43002?** Yes. horizon (PyPI): upgrade to 25.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43002 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-43002?** Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- horizon (PyPI): upgrade to 25.7.3 or later

  ```sh
  pip install "horizon>=25.7.3"
  ```


## Technical details

A denial-of-service vulnerability exists in OpenStack Horizon due to a regression of a previous fix (CVE-2014-8124). The 'login' view in 'openstack_auth/views.py' incorrectly writes a 'post_login_redirect' URL to the session storage backend before a user has authenticated. Because Django's SessionMiddleware persists a new session record whenever the session dictionary is modified, an unauthenticated attacker can send repeated GET requests to '/auth/login/?next=URL' without a session cookie to force the creation of unbounded session records. This can exhaust backends such as Memcached, Redis, or SQL databases, leading to the eviction of legitimate sessions or service failure. The issue is fixed in version 25.7.3 by moving the redirect storage out of the server-side session.

## Affected products

- OpenStack Horizon >=25.6.0 <25.7.3

## Identifiers

- CVE-2026-43002
- GHSA-vxvf-xvm3-p8j5
- PYSEC-2026-2520

## Timeline

- 2026-04-25: disclosed: Bug reported to OpenStack Launchpad
- 2026-04-27: advisory: OpenStack Security Advisory OSSA-2026-009 issued
- 2026-05-05: patched: CVE published and fix released in version 25.7.3

## References

- [https://bugs.launchpad.net/horizon/+bug/2150331](https://bugs.launchpad.net/horizon/+bug/2150331)
- [https://security.openstack.org/ossa/OSSA-2026-009.html](https://security.openstack.org/ossa/OSSA-2026-009.html)
- [https://www.openwall.com/lists/oss-security/2026/05/05/7](https://www.openwall.com/lists/oss-security/2026/05/05/7)

## Related threats

- [PYSEC-2026-821 - OpenStack Horizon Cross-site Scripting (XSS)](https://junglewise.ai/threats/cve-2017-7400-openstack-horizon-cross-site-scripting-xss)
- [PYSEC-2026-822 - OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2014-0157-openstack-dashboard-aka-horizon-vulnerable-to-cross-site-scripting)
- [PYSEC-2026-642 - Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name](https://junglewise.ai/threats/cve-2014-3473-horizon-orchestration-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-644 - OpenStack Horizon Cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2014-3474-openstack-horizon-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-641 - OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface](https://junglewise.ai/threats/cve-2014-3594-openstack-dashboard-horizon-cross-site-scripting-xss-vulnerability)