4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44919

CVE-2026-44919: OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44919

CVE-2026-44919:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ironic	pip	<= 36.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in OpenStack Ironic's image handling process. It stems from insufficient validation of file:// URLs provided as the image source. The core issue lies in the build_instance_info_for_deploy function, which, prior to the patch, would not validate the path of a file:// URL against a security blocklist. This allowed an attacker to specify a local device file, such as file:///dev/zero, as the image source.

The build_instance_info_for_deploy function would then call _cache_and_convert_image to process this malicious URL. This would lead to the system attempting to calculate a checksum on /dev/zero, a special file that produces an infinite stream of null characters. This action consumes the conductor thread indefinitely, leading to a Denial of Service as the thread becomes permanently unavailable.

The patch addresses this by introducing an explicit validation step. It adds a call to image_service.FileImageService().validate_href() within build_instance_info_for_deploy for any file:// URL, ensuring the path is checked against a blocklist before any processing, such as checksumming in _cache_and_convert_image, is initiated. This prevents the system from attempting to read from dangerous device files.

Vulnerable functions

ironic.drivers.modules.deploy_utils.build_instance_info_for_deploy

ironic/drivers/modules/deploy_utils.py

This function is the entry point for the vulnerability. It processes the `image_source` URL. Before the patch, it would directly call `_cache_and_convert_image` for a `file://` URL without first validating if the file path was on a blocklist. This allowed a malicious URL pointing to a device file like `/dev/zero` to be processed.

ironic.drivers.modules.deploy_utils._cache_and_convert_image

ironic/drivers/modules/deploy_utils.py

This function is called by `build_instance_info_for_deploy` and is responsible for caching the image and, as the release notes imply, initiating the checksum calculation. When passed a URL like `file:///dev/zero`, this function or a subsequent function it calls would enter an infinite loop trying to read from the device to calculate a checksum, causing a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.