GitHub Advisoryadvisory · PyPI

GHSA-q3g8-rjrx-59ph OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash

MEDIUM Published 2026-06-05 Modified 2026-07-15 Official page ↗
Aliases
CVE-2026-50589
Ecosystem
PyPI
Packages
ironic
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-502, CWE-770
Reviewed
2026-07-15

Affected packages

• PyPI ironic: >= 32.0.0, < 37.0.0 → fixed in 37.0.0

Description

In OpenStack Ironic 32.0.0 through 35.0.1, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

Related

Alias · CVE (1)

  • CVE-2026-50589 In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or… vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References