GHSA-4g73-w726-53h3

OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-44919

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ironic	<= 36.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-44919 advisory
https://bugs.launchpad.net/ironic/+bug/2150332 web
https://opendev.org/openstack/ironic package
https://opendev.org/openstack/ironic/commit/a3f6d735ac3642ab95b49142c7305f072ae748d0 web
https://security.openstack.org/ossa/OSSA-2026-013.html web