CVE-2026-44919: 
OpenStack Ironic vulnerability analysis and mitigation

CVE-2026-44919 is a Denial of Service vulnerability in OpenStack Ironic, titled "Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices." During image handling, an infinite loop in checksum calculations can be triggered by supplying the file:///dev/zero URL, causing the service to become unresponsive. It affects OpenStack Ironic through version 35.x (pip package ironic <= 36.0.0) prior to commit a3f6d73. The vulnerability was published on May 14, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-696 (Incorrect Behavior Order), where checksum validation logic reads from a supplied image URL before adequately validating or restricting the URL scheme. By providing file:///dev/zero — a Linux pseudo-device that produces an infinite stream of null bytes — the checksum calculation enters an infinite loop, consuming CPU and blocking the image handling process indefinitely. Exploitation requires low-privilege authenticated network access (no user interaction needed), making it accessible to any authenticated Ironic user who can submit image URLs. The fix is tracked in commit a3f6d735ac3642ab95b49142c7305f072ae748d0 on the OpenStack Ironic repository (GitHub Advisory, OpenDev Commit).

Successful exploitation causes the Ironic image handling service to enter an infinite loop, rendering it unresponsive and resulting in a Denial of Service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In a cloud infrastructure context, disruption of the Ironic bare-metal provisioning service could prevent new node deployments or reprovisioning operations, potentially impacting operational continuity for dependent workloads (GitHub Advisory, ENISA EUVD).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013–0.014% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with low privileges, which somewhat limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, ENISA EUVD).

1. Authentication: Obtain low-privilege credentials for an OpenStack environment running a vulnerable version of Ironic (through 35.x / pip ironic <= 36.0.0 before commit a3f6d73).
2. Identify image handling endpoint: Locate the Ironic API endpoint that accepts image URLs for bare-metal node provisioning or image import operations.
3. Submit malicious URL: Submit a request to the Ironic image handling workflow specifying file:///dev/zero as the image source URL (e.g., via the Ironic API's image or node deployment parameters).
4. Trigger infinite loop: Ironic begins computing a checksum of the supplied URL's content without first validating the URL scheme; since /dev/zero produces infinite null bytes, the checksum calculation never completes.
5. Service disruption: The Ironic image handling process becomes permanently blocked, causing a Denial of Service for all users relying on the provisioning service until the process is manually restarted (GitHub Advisory, OpenDev Commit).

• Logs: Ironic service logs showing a stalled or non-completing image checksum operation with a file:///dev/zero URL reference; absence of completion log entries for image handling tasks that were initiated.
• Process: Ironic conductor or API worker process consuming sustained high CPU with no progress, associated with a checksum or image download operation.
• Network: API audit logs recording an authenticated request to the Ironic image handling endpoint with file:///dev/zero as the image URL parameter.
• Service Health: Ironic provisioning operations timing out or queuing indefinitely; monitoring alerts for Ironic conductor unresponsiveness or heartbeat failures (GitHub Advisory).

The primary remediation is to update OpenStack Ironic to a version that includes commit a3f6d735ac3642ab95b49142c7305f072ae748d0 or later, which addresses the pre-validation checksum calculation flaw. As a configuration-based workaround, operators should implement input validation to reject or sanitize file:/// URLs in image handling workflows, and restrict accepted image source URLs to approved protocols (e.g., http://, https://) and trusted hosts only. The OpenStack Security Advisory OSSA-2026-013 provides official guidance (GitHub Advisory, OpenStack OSSA).

The vulnerability was discussed briefly on the oss-security mailing list following disclosure (oss-sec). Social media activity was limited to automated CVE tracking accounts on Bluesky. No significant vendor statements beyond the official OpenStack Security Advisory (OSSA-2026-013) or notable independent researcher commentary have been identified. Community reaction has been muted, consistent with the moderate severity and limited exploitation potential of the vulnerability.