Allocation of resources without limits or throttling in Openstack Nova - CVE-2026-24708

Vulnerability identifier: #VU122995

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-24708

CWE-ID: CWE-770

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to the application calls qemu-img without format restrictions for resize. A local user can write malicious QCOW header to a root or ephemeral disk and then trigger a resize to convince Nova’s flat image backend to call qemu-img without a format restriction resulting in an unsafe image resize operation that could destroy data on the host system.

Openstack Nova
Debian Linux
Ubuntu
collectd-sensubility (Red Hat package)
openstack-selinux (Red Hat package)
ansible-collection-ansible-posix (Red Hat package)
python-cinder-tests-tempest (Red Hat package)
ansible-collections-openstack (Red Hat package)
python-ovsdbapp (Red Hat package)
python-glance-store (Red Hat package)
openstack-swift (Red Hat package)
tripleo-ansible (Red Hat package)
etcd (Red Hat package)
python-oslo-serialization (Red Hat package)
python-os-brick (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
puppet-rabbitmq (Red Hat package)
python-oslo-messaging (Red Hat package)
os-net-config (Red Hat package)
puppet-tripleo (Red Hat package)
openstack-tripleo-heat-templates (Red Hat package)
openstack-heat (Red Hat package)
openstack-ironic (Red Hat package)
rhosp-director-images (Red Hat package)
rhosp-director-images-uefi-fips-x86_64 (Red Hat package)
rhosp-director-images-multirhel-x86_64 (Red Hat package)
rhosp-director-images-fips-x86_64 (Red Hat package)
rhosp-director-images-ipa-fips-x86_64 (Red Hat package)
rhosp-director-images-ipa-x86_64 (Red Hat package)
rhosp-director-images-minimal (Red Hat package)
rhosp-director-images-minimal-fips (Red Hat package)
rhosp-director-images-uefi-x86_64 (Red Hat package)
rhosp-director-images-x86_64 (Red Hat package)
octavia-amphora-image-x86_64 (Red Hat package)
octavia-amphora-image-fips-x86_64 (Red Hat package)
openstack-cinder (Red Hat package)
openstack-neutron (Red Hat package)
openstack-keystone (Red Hat package)
python-django-horizon (Red Hat package)
openstack-nova (Red Hat package)
erlang (Red Hat package)
nova (Ubuntu package)
nova (Debian package)
Red Hat OpenStack

Install updates from vendor's website.

Openstack Nova - addressed in versions 30.2.2, 31.2.1, 32.1.1
collectd-sensubility (Red Hat package) - update to 0.2.1-6.el9ost
openstack-selinux (Red Hat package) - update to 0.8.37-17.1.20260107141051.05dd1b2.el9ost
ansible-collection-ansible-posix (Red Hat package) - update to 1.2.0-1.4.el9ost
python-cinder-tests-tempest (Red Hat package) - update to 1.8.0-17.1.20260114160833.0e94611.el9ost
ansible-collections-openstack (Red Hat package) - update to 1.9.1-17.1.20260318160829.0e9a6f2.el9ost
python-ovsdbapp (Red Hat package) - update to 1.9.4-17.1.20260304101059.65d02f0.el9ost
python-glance-store (Red Hat package) - update to 2.5.1-17.1.20260225150839.5f1cee6.el9ost
openstack-swift (Red Hat package) - update to 2.27.1-17.1.20260806131309.16dbcae.el9ost
tripleo-ansible (Red Hat package) - update to 3.3.1-17.1.20260603190918.8debef3.el9ost
etcd (Red Hat package) - update to 3.4.26-9.6.el9ost
python-oslo-serialization (Red Hat package) - update to 4.1.1-17.1.20260326121047.bbe5d5a.el9ost
python-os-brick (Red Hat package) - update to 4.3.4-17.1.20260324150947.cf69f92.el9ost
openstack-ironic-python-agent (Red Hat package) - update to 7.1.1-17.1.20260803104219.0211fa9.el9ost
puppet-rabbitmq (Red Hat package) - update to 11.0.1-17.1.20260306080955.63fee2c.el9ost
python-oslo-messaging (Red Hat package) - update to 12.7.3-17.1.20260701150916.5d6fd1a.el9ost
os-net-config (Red Hat package) - update to 14.2.1-17.1.20260803103231.61d7bd7.el9ost
puppet-tripleo (Red Hat package) - update to 14.2.3-17.1.20260206090839.40278e1.el9ost
openstack-tripleo-heat-templates (Red Hat package) - update to 14.3.1-17.1.20260803105013.e7c7ce3.el9ost
openstack-heat (Red Hat package) - update to 16.1.1-17.1.20260713101101.edc6d60.el9ost
Red Hat OpenStack - update to 17.1
openstack-ironic (Red Hat package) - update to 17.1.1-17.1.20260721220909.c31db88.el9ost
rhosp-director-images (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-uefi-fips-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-multirhel-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-fips-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-ipa-fips-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-ipa-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-minimal (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-minimal-fips (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-uefi-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
rhosp-director-images-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
octavia-amphora-image-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
octavia-amphora-image-fips-x86_64 (Red Hat package) - update to 17.1-20260901.1.el9ost
openstack-cinder (Red Hat package) - update to 18.2.2-17.1.20260702111621.f6b44fc.el9ost
openstack-neutron (Red Hat package) - update to 18.6.1-17.1.20260810120959.85ff760.el9ost
openstack-keystone (Red Hat package) - update to 19.0.2-17.1.20260630150819.54dd95d.el9ost
python-django-horizon (Red Hat package) - update to 19.4.1-17.1.20260630130603.9b1a13e.el9ost
openstack-nova (Red Hat package) - addressed in versions 23.2.3-17.1.20260810140853.2ace99d.el9ost, 27.5.2-18.0.20260312122217.c1c6d67.el9ost
erlang (Red Hat package) - update to 24.3.4.2-7.el9ost
nova (Ubuntu package) - addressed in versions 3:25.2.1-0ubuntu2.10, 3:29.2.0-0ubuntu1.3, 3:32.0.0-0ubuntu1.1
nova (Debian package) - addressed in versions 2:26.2.2-1~deb12u4, 2:31.0.0-6+deb13u2

• https://security.openstack.org/ossa/OSSA-2026-002.html
• https://bugs.launchpad.net/nova/+bug/2137507

• Local denial of service in OpenStack Nova
• Ubuntu update for nova
• Debian update for nova
• Red Hat OpenStackServices on OpenShift 18 update for openstack-nova
• Multiple vulnerabilities in Red Hat OpenStack 17.1 packages