Openstack (Redhat) - vulnerabilities (CVEs)

341 CVEs, 20 in the last 30 days, 46 known versions, newest CVE from 2026-10-21. Vendor: Redhat.

CVEs of Openstack

CVE-2026-114236 - CVSS 3.3 (low), 2026-10-21: storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls…
CVE-2026-92982 - CVSS 8.5 (high), 2026-10-15: A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious…
CVE-2026-86849 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host…
CVE-2026-86856 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured,…
CVE-2026-86847 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails,…
CVE-2026-86846 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an…
CVE-2026-86845 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type…
CVE-2026-86566 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared…
CVE-2026-86848 - CVSS 8.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to…
CVE-2026-86567 - CVSS 8.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVE-2026-100236 - CVSS 8.6 (high), 2026-10-14: A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first…
CVE-2026-86565 - CVSS 8.2 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host…
CVE-2026-86563 - CVSS 7.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
CVE-2026-86562 - CVSS 7.8 (high), 2026-10-14: A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the…
CVE-2026-86561 - CVSS 6.5 (medium), 2026-10-14: A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or…
CVE-2026-93683 - CVSS 6.4 (medium), 2026-10-14: A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory…
CVE-2026-83535 - CVSS 7.4 (high), 2026-10-12: A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the…
CVE-2026-83536 - CVSS 5.3 (medium), 2026-10-12: A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as…
CVE-2026-107935 - CVSS 9.3 (critical), 2026-10-09: A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated…
CVE-2026-89091 - CVSS 8.8 (high), 2026-10-08: A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using…
CVE-2026-93834 - CVSS 8.8 (high), 2026-09-25: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent…
CVE-2026-81627 - CVSS 8.2 (high), 2026-09-18: A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A…
CVE-2026-92091 - CVSS 5.9 (medium), 2026-09-16: A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time…
CVE-2026-75092 - CVSS 7.3 (high), 2026-09-15: A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades,…
CVE-2026-84828 - CVSS 6.5 (medium), 2026-09-10: A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token'…
CVE-2026-87872 - CVSS 6.8 (medium), 2026-09-09: A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS…
CVE-2026-87874 - CVSS 8.1 (high), 2026-09-09: A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON…
CVE-2026-84185 - CVSS 5.9 (medium), 2026-09-03: A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the…
CVE-2026-80179 - CVSS 5.9 (medium), 2026-08-27: A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This…
CVE-2026-80158 - CVSS 5.5 (medium), 2026-08-26: A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind…
CVE-2026-11998 - CVSS 7.6 (high), 2026-06-24: A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript…
CVE-2026-49759 - CVSS 8.8 (high), 2026-06-10: Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a crafted…
CVE-2026-11837 - CVSS 7.3 (high), 2026-06-10: A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of…
CVE-2026-50589 - CVSS 7.5 (high), 2026-06-05: In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service…
CVE-2026-44393 - CVSS 7.4 (high), 2026-06-04: An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when…
CVE-2026-41283 - CVSS 9.9 (critical), 2026-06-04: OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead…
CVE-2026-27145 - CVSS 7.5 (high), 2026-06-02: (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused…
CVE-2026-42999 - CVSS 8.8 (high), 2026-05-28: An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request…
CVE-2026-43000 - CVSS 8.8 (high), 2026-05-28: An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the…
CVE-2026-42790 - CVSS 8.1 (high), 2026-05-27: Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject…
CVE-2026-42789 - CVSS 8 (high), 2026-05-27: Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as…
CVE-2026-39821 - CVSS 9.6 (critical), 2026-05-22: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")…
CVE-2026-46595 - CVSS 10 (critical), 2026-05-22: Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key,…
CVE-2026-42508 - CVSS 9.1 (critical), 2026-05-22: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for…
CVE-2026-39835 - CVSS 7.5 (high), 2026-05-22: SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting…
CVE-2026-39828 - CVSS 8.8 (high), 2026-05-22: When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially…
CVE-2026-39832 - CVSS 9.1 (critical), 2026-05-22: When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination…
CVE-2026-39830 - CVSS 9.1 (critical), 2026-05-22: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine…
CVE-2026-39829 - CVSS 7.5 (high), 2026-05-22: The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter…
CVE-2026-41292 - CVSS 7.5 (high), 2026-05-20: NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options.…
CVE-2026-31072 - CVSS 9.8 (critical), 2026-05-19: The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure…
CVE-2026-44432 - CVSS 8.9 (high), 2026-05-13: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1)…
CVE-2026-42499 - CVSS 7.5 (high), 2026-05-07: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVE-2026-39820 - CVSS 7.5 (high), 2026-05-07: Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
CVE-2026-33814 - CVSS 7.5 (high), 2026-05-07: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a…
CVE-2026-33811 - CVSS 7.5 (high), 2026-05-07: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
CVE-2026-42997 - CVSS 7.7 (high), 2026-05-05: An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote…
CVE-2026-34956 - CVSS 5.9 (medium), 2026-05-05: A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can…
CVE-2026-43869 - CVSS 7.3 (high), 2026-05-05: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended…
CVE-2026-42151 - CVSS 7.5 (high), 2026-05-04: Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote…
CVE-2026-42154 - CVSS 7.5 (high), 2026-05-04: Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not…
CVE-2026-43001 - CVSS 8 (high), 2026-05-01: An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type…
CVE-2026-41602 - CVSS 7.5 (high), 2026-04-28: Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.…
CVE-2025-48431 - CVSS 7.5 (high), 2026-04-28: Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are…
CVE-2026-32283 - CVSS 7.5 (high), 2026-04-08: If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled…
CVE-2026-32280 - CVSS 7.5 (high), 2026-04-08: During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in…
CVE-2026-33810 - CVSS 8.8 (high), 2026-04-08: When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different…
CVE-2026-32144 - CVSS 7.6 (high), 2026-04-07: Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing…
CVE-2026-28808 - CVSS 9.8 (critical), 2026-04-07: Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via…
CVE-2026-34986 - CVSS 7.5 (high), 2026-04-06: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE),…
CVE-2026-34881 - CVSS 7.1 (high), 2026-03-31: OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated…
CVE-2026-32285 - CVSS 7.5 (high), 2026-03-26: The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic,…
CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
CVE-2026-32875 - CVSS 7.5 (high), 2026-03-20: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.10 through 5.11.0 are vulnerable to buffer overflow…
CVE-2026-32874 - CVSS 7.5 (high), 2026-03-20: UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Versions 5.4.0 through 5.11.0 contain an accumulating memory…
CVE-2026-30922 - CVSS 7.5 (high), 2026-03-18: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled…
CVE-2026-27459 - CVSS 9.8 (critical), 2026-03-18: pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to…
CVE-2026-25679 - CVSS 7.5 (high), 2026-03-06: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2026-27137 - CVSS 7.5 (high), 2026-03-06: When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different…
CVE-2025-15558 - CVSS 8 (high), 2026-03-04: Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged…
CVE-2026-24708 - CVSS 8.2 (high), 2026-02-18: An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral…
CVE-2026-1312 - CVSS 8.5 (high), 2026-02-03: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases…
CVE-2026-1287 - CVSS 8.3 (high), 2026-02-03: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via…
CVE-2026-1207 - CVSS 8.3 (high), 2026-02-03: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows…
CVE-2025-61726 - CVSS 7.5 (high), 2026-01-28: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited…
CVE-2026-0994 - CVSS 8.2 (high), 2026-01-23: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when…
CVE-2025-56005 - CVSS 9.8 (critical), 2026-01-20: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()`…
CVE-2026-22797 - CVSS 9.9 (critical), 2026-01-19: An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1.…
CVE-2026-23490 - CVSS 7.5 (high), 2026-01-16: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed…
CVE-2026-0532 - CVSS 8.6 (high), 2026-01-14: External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary file disclosure…
CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
CVE-2026-22184 - CVSS 8.6 (high), 2026-01-07: zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to…
CVE-2025-14010 - CVSS 5.5 (medium), 2025-12-04: A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically…
CVE-2021-4472 - CVSS 6.5 (medium), 2025-11-26: The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of…
CVE-2025-8556 - CVSS 3.7 (low), 2025-08-06: A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order…
CVE-2023-6110 - CVSS 5.5 (medium), 2024-11-17: A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not…
CVE-2023-1932 - CVSS 6.1 (medium), 2024-11-07: A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can…
CVE-2024-9902 - CVSS 6.3 (medium), 2024-11-06: A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any…
CVE-2024-9355 - CVSS 6.5 (medium), 2024-10-01: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed…
CVE-2024-8007 - CVSS 8.1 (high), 2024-08-21: A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy…