Sign in
Deutsch English Español Polski
High

OpenStack Nova calls qemu-img without format restrictions for resize

  • Disclosed: 18.02.2026
  • Updated: 11.10.2026 14:18

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) nova >= 32.0.0.0rc1, <= 32.1.0, >= 31.0.0.0rc1, <= 31.2.0, <= 30.2.1 no fix

References

CVSS score 8.2/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Weakness (CWE)
CWE-669
Platform
Python (PyPI)
Package
nova
Disclosed
18.02.2026
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-2685 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-m4f3-qp2w-gwh6 - CC BY 4.0

Vulnerability history: nova

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (49) in the archive
Total entries
49
First → latest
08.2012 06.2026
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 11
  • Medium 29
  • Low 8

Disclosures per year

earlier: 7

Severity:
  1. OpenStack Nova calls qemu-img without format restrictions for resize this entry
    High · 8.2 CVE-2026-24708 >= 32.0.0.0rc1, <= 32.1.0, >= 31.0.0.0rc1, <= 31.2.0, <= 30.2.1 no fix
  2. OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
    High · 7.5 CVE-2015-5162 < 12.0.4 12.0.4
  3. OpenStack Nova logs sensitive context from notification exceptions
    Critical · 9.8 CVE-2017-7214 >= 13.0.0, < 13.1.4, >= 14.0.0, < 14.0.5, >= 15.0.1, < 15.0.2 13.1.4, 14.0.5, 15.0.2
  4. OpenStack Nova Denial of service attack on the compute host
    High · 7.5 CVE-2017-18191 >= 15.0.0, < 15.1.1, >= 16.0.0, < 16.1.2 15.1.1, 16.1.2
  5. OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
    High · 8.6 CVE-2017-17051 < 16.0.4 16.0.4
  6. An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously underg
    High · 8.3 CVE-2020-17376 < 19.3.1, >= 20.0.0, < 20.3.1, >= 21.0.0, < 21.1.0 19.3.1, 20.3.1, 21.1.0
  7. An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exceptio
    High · 6.5 CVE-2019-14433 >= 19.0.0, < 19.0.2, < 17.0.12, >= 18.0.0, < 18.2.2 19.0.2, 17.0.12, 18.2.2
  8. OpenStack Nova VMWare driver leaks rescued images
    High · 6.5 CVE-2014-2573 < 12.0.0a0 12.0.0a0
  9. OpenStack Nova Live migration can leak root disk into ephemeral storage
    High · 7.5 CVE-2013-7130 < 12.0.0a0 12.0.0a0
  10. OpenStack Compute Nova Unauthorised access to arbitrary VM using VNC token from deleted VM
    High · 6.5 CVE-2013-0335 < 12.0.0a0 12.0.0a0
  11. OpenStack Compute (Nova) Denial of service via a large number of calls to the addFixedIp function
    High · 6.5 CVE-2013-1838 < 12.0.0a0 12.0.0a0
  12. virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an ima
    High · 6.5 CVE-2012-3447 all versions no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.