VDB
Sign up
HIGH7.5

PYSEC-2026-871

OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption

Quick fix

PYSEC-2026-871 — nova: upgrade to the fixed version with the command below.

pip install --upgrade 'nova>=12.0.4'

Details

The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/nova
Introduced in: 0Fixed in: 12.0.4
Fixpip install --upgrade 'nova>=12.0.4'

References