Description
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openstack-neutron | As shipped with Red Hat Openstack 13, 16.1, and 16.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | neutron | 2:21.0.0~rc1-3 | — |
| Debian 13 | neutron | 2:21.0.0~rc1-3 | — |
| Debian 12 | neutron | 2:21.0.0~rc1-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | neutron | 2:20.3.0-0ubuntu1.1 | USN-6067-1 |
| Ubuntu 20.04 LTS | neutron | 2:16.4.2-0ubuntu6.2 | USN-6067-1 |
| Ubuntu 18.04 LTS | neutron | 2:12.1.1-0ubuntu8.1 | USN-6067-1 |
| Ubuntu 16.04 LTS | neutron | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | openstack-neutron | 1:18.4.1-0.20221128170741.5258354.el9ost | RHSA-2023:0275 |
| Red Hat OpenStack 16 | python3-neutron +9 | 1:15.2.1-1.20221005123225.40d217c.el8ost | RHSA-2022:8870, RHSA-2022:8855 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | neutron | >= 19.0.0.0rc1, < 19.5.0 | 19.5.0 | GHSA-w446-h7vg-wv3p |
| PyPI | neutron | < 18.6.0 | 18.6.0 | GHSA-w446-h7vg-wv3p |
| PyPI | neutron | >= 20.0.0.0rc1, < 20.3.0 | 20.3.0 | GHSA-w446-h7vg-wv3p |
| PyPI | neutron | < 18.6.0 · >= 19.0.0.0rc1, < 19.5.0 · >= 20.0.0.0rc1, < 20.3.0 | 18.6.0, 19.5.0, 20.3.0 | PYSEC-2026-855 |
Advisories 5
- RHSA-2023:0275 Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-neutron) security update Red Hat Security Advisories (RHSA) · Aug 4, 2026
- RHSA-2022:8870 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-neutron) security update Red Hat Security Advisories (RHSA) · Aug 4, 2026
- RHSA-2022:8855 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (openstack-neutron) security update Red Hat Security Advisories (RHSA) · Aug 4, 2026
- USN-6067-1 neutron vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2022-2265 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2025