Executive brief
OpenStack Ironic, a service for managing bare metal hardware, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a specially crafted data string to the service's API, causing the application to crash. This disrupts the ability to manage or provision physical servers until the service is manually or automatically restarted.
Technical details
A vulnerability exists in OpenStack Ironic (versions 32.0.0 to 36.x) due to improper handling of untrusted JSON data before authentication checks occur. Specifically, the `method.body` decorator parses the full JSON body before verifying credentials. An attacker can submit a deeply nested or crafted JSON string (e.g., a large number of opening brackets) that exceeds the Python runtime stack size, leading to a SIGSEGV or recursion error that crashes the service process. While reverse proxies like Nginx may mitigate large payloads, the crash can be triggered with payloads smaller than 1MB. The issue is addressed in version 37.0.0 by implementing content length checks and improving resource allocation limits during deserialization.
Affected products
- OpenStack ironic >= 32.0.0, < 37.0.0
Timeline
- 2026-05-26: disclosed: Vulnerability reported by Metal3.io security team
- 2026-06-05: advisory: GitHub Advisory and NVD record published
- 2026-07-15: patched: Advisory updated with patched version information