Keystone: openstack keystone: denial of service via large http request with long tenant name
Summary
| CVE | CVE-2013-0270 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-04-12 22:55:01 UTC |
| Updated | 2026-04-07 07:16:23 UTC |
| Description | A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.026810000 probability, percentile 0.858080000 (date 2026-04-07)
Problem Types: CWE-1284 | CWE-119 | CWE-1284 Improper Validation of Specified Quantity in Input
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:L/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Openstack | Keystone | 2013.1 | milestone1 | All | All |
| Application | Openstack | Keystone | 2013.1 | milestone2 | All | All |
| Application | Openstack | Keystone | 2013.1 | milestone3 | All | All |
| Application | Openstack | Keystone | All | All | All | All |
| Application | Openstack | Keystone | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat OpenStack Platform 13 Queens | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenStack Platform 16.2 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenStack Platform 16.2 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenStack Platform 17.1 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenStack Platform 17.1 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenStack Platform 18.0 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenStack Platform 18.0 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug #1099025 “block really large requests” : Bugs : OpenStack Identity (keystone) | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | Third Party Advisory |
| 2013.1 "grizzly" : Series grizzly : Keystone | af854a3a-2127-422b-91ae-364da2661108 | launchpad.net | Patch, Third Party Advisory |
| Limit the size of HTTP requests. · openstack/keystone@7691276 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Third Party Advisory |
| access.redhat.com/security/cve/CVE-2013-0270 | [email protected] | access.redhat.com | |
| 909012 – (CVE-2013-0270) CVE-2013-0270 OpenStack Keystone: Large HTTP request DoS | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | Third Party Advisory |
| Merge "Add size validations for /tokens." into stable/folsom · openstack/keystone@82c87e5 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-04-02T15:03:35.327Z | Reported to Red Hat. |
| CNA | 2013-04-12T22:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
There are currently no legacy QID mappings associated with this CVE.