early signals oss-security infra

[OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

// AI summary

Ironic versions 16.2.0 29.1.1, 30.0.0 32.1.1, 33.0.0 35.1.1, and 36.0.0 39.0.1 have CVE-2026-115638, allowing a Conductor DoS via gzip bomb configdrive.

// from the source

Posted by Jay Faulkner on Oct 29 ============================================================= OSSA-2026-049: Ironic Conductor DoS via gzip bomb configdrive ============================================================= :Date: October 29, 2026 :CVE: CVE-2026-115638 Affects ~~~~~~~ - Ironic: =16.2.0 29.1.1, =30.0.0 32.1.1, =33.0.0 35.1.1, =36.0.0 39.0.1 Description ~~~~~~~~~~~ Jay Faulkner of G-Research Open Source Software reported a...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org
  5. oss-security infra

    CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

    seclists.org