CVE-2026-115638
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
The record
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… CWE-409
- CVE-2026-118261 Echo is a Go web framework. CWE-409
- CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a… CWE-409
- CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. CWE-409
- CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted… CWE-409
- CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in… CWE-409
- CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the… CWE-409
- CVE-2026-115503 Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability… CWE-409