CVE-2026-44919 Details

A denial-of-service vulnerability has been identified in OpenStack Ironic versions through 35.x prior to a3f6d73. The issue arises during image handling when an authenticated user can specify a file URL pointing to an infinite byte stream, such as file:///dev/zero. This causes the checksum calculation process to enter an infinite loop, stalling the associated worker thread indefinitely. The vulnerability exploits a logic error where checksum validations are performed before checking the URL against a blocklist of sensitive file paths. As a result, the conductor threads can be exhausted, leading to a full service denial-of-service condition.

Users can update to OpenStack Ironic versions 35.0.1 or later, where this vulnerability has been patched.