{"api_version":"1","generated_at":"2026-10-12T22:06:00+00:00","cve":"CVE-2026-83536","urls":{"html":"https://cve.report/CVE-2026-83536","api":"https://cve.report/api/cve/CVE-2026-83536.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-83536","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-83536"},"summary":{"title":"Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)","description":"A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-10-12 19:16:39","updated_at":"2026-10-12 19:16:39"},"problem_types":["CWE-400","CWE-400 Uncontrolled Resource Consumption"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Primary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526401","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2526401","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2026-83536","name":"https://access.redhat.com/security/cve/CVE-2026-83536","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-83536","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83536","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-08-31T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-10-12T18:28:52.398Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Restrict network access to the `openstack-network-exporter` service. Configure firewall rules to limit incoming connections to port 1981 (the default port for the exporter) only from trusted hosts or networks that require access for Prometheus scraping. This will reduce the attack surface by preventing unauthenticated adjacent attackers from reaching the service. Applying firewall rules may require restarting network services or the firewall daemon to take effect.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0"],"defaultStatus":"affected","packageName":"rhoso-operators/openstack-network-exporter-rhel9","product":"Red Hat OpenStack Platform 18.0","vendor":"Red Hat"}],"datePublic":"2026-10-12T18:28:52.398Z","descriptions":[{"lang":"en","value":"A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"Uncontrolled Resource Consumption","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-12T18:50:23.855Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-83536"},{"name":"RHBZ#2526401","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526401"}],"timeline":[{"lang":"en","time":"2026-08-31T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-12T18:28:52.398Z","value":"Made public."}],"title":"Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)","workarounds":[{"lang":"en","value":"Restrict network access to the `openstack-network-exporter` service. Configure firewall rules to limit incoming connections to port 1981 (the default port for the exporter) only from trusted hosts or networks that require access for Prometheus scraping. This will reduce the attack surface by preventing unauthenticated adjacent attackers from reaching the service. Applying firewall rules may require restarting network services or the firewall daemon to take effect."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-400: Uncontrolled Resource Consumption"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-83536","datePublished":"2026-10-12T18:50:23.855Z","dateReserved":"2026-08-31T16:53:08.479Z","dateUpdated":"2026-10-12T18:50:23.855Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-12 19:16:39","lastModifiedDate":"2026-10-12 19:16:39","problem_types":["CWE-400","CWE-400 Uncontrolled Resource Consumption"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"83536","Ordinal":"1","Title":"Openstack-network-exporter: http.server has no readheadertimeout","CVE":"CVE-2026-83536","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"83536","Ordinal":"1","NoteData":"A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.","Type":"Description","Title":"Openstack-network-exporter: http.server has no readheadertimeout"}]}}}