CVE-2026-50589

Published: Jun 5, 2026Modified: Jul 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.

Affected (1)

Products: Openstack: Ironic

Openstack

1 product

Ironic

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openstack Ironic	From 32.0.0 to 37.0.0

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (7)

https://bugs.launchpad.net/ironic/+bug/2154288

Source: cve@mitre.org

Issue TrackingMitigation

https://wiki.openstack.org/wiki/OSSN/OSSN-0099

Source: cve@mitre.org

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2026/06/06/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://access.redhat.com/security/cve/CVE-2026-50589

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugs.launchpad.net/ironic/+bug/2154288

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Issue TrackingMitigation

https://bugzilla.redhat.com/show_bug.cgi?id=2485353

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50589.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.