CVE-2026-24708
Fixed in a distro release EPSS <1%CVSS 8.2
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Products: OpenStack Nova, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Services on OpenShift 18.0, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nova | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | nova | 2:22.4.0-1~deb11u7 |
| Debian 12 | nova | 2:26.2.2-1~deb12u4 |
| Debian 13 | nova | 2:31.0.0-6+deb13u2 |
| Debian 14 | nova | 2:32.1.0-7 |
| Red Hat openstack 16.2 | collectd-sensubility | 0:0.2.1-1.1.el8ost |
| Red Hat openstack 16.2 | collectd-sensubility-debuginfo | 0:0.2.1-1.1.el8ost |
| Red Hat openstack 16.2 | erlang | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-asn1 | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-asn1-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-compiler | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-crypto | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-crypto-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-debugsource | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-eldap | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-erl_interface-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-erts | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-erts-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-hipe | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-inets | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-kernel | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-mnesia | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-odbc-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-os_mon | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-os_mon-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-parsetools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-public_key | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-runtime_tools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-runtime_tools-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-sasl | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-snmp | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-ssl | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-stdlib | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-syntax_tools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-tools | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-tools-debuginfo | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | erlang-xmerl | 0:23.3.4.18-2.el8ost |
| Red Hat openstack 16.2 | etcd | 0:3.3.23-22.el8ost |
| Red Hat openstack 16.2 | etcd-debuginfo | 0:3.3.23-22.el8ost |
| Red Hat openstack 16.2 | etcd-debugsource | 0:3.3.23-22.el8ost |
| Red Hat openstack 16.2 | openstack-glance | 1:19.0.5-2.20260512165254.eb6ad61.el8ost |
| Red Hat openstack 16.2 | openstack-keystone | 1:16.0.3-2.20260616134936.9d699a7.el8ost |
| Red Hat openstack 16.2 | openstack-nova | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-api | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-common | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-compute | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-conductor | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-console | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-migration | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-novncproxy | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-scheduler | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-serialproxy | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | openstack-nova-spicehtml5proxy | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | python-oslo-messaging | 0:10.2.4-2.20260710155333.82281a0.el8ost |
| Red Hat openstack 16.2 | python-pyasn1 | 0:0.4.6-4.el8ost |
| Red Hat openstack 16.2 | python3-glance | 1:19.0.5-2.20260512165254.eb6ad61.el8ost |
| Red Hat openstack 16.2 | python3-keystone | 1:16.0.3-2.20260616134936.9d699a7.el8ost |
| Red Hat openstack 16.2 | python3-nova | 1:20.6.2-2.20260317135026.8a24acd.el8ost |
| Red Hat openstack 16.2 | python3-oslo-messaging | 0:10.2.4-2.20260710155333.82281a0.el8ost |
| Red Hat openstack 16.2 | python3-pyasn1 | 0:0.4.6-4.el8ost |
| Red Hat openstack 16.2 | python3-pyasn1-modules | 0:0.4.6-4.el8ost |
| Red Hat openstack 17.1 | ansible-collection-ansible-posix | 0:1.2.0-1.4.el9ost |
| Red Hat openstack 17.1 | ansible-collections-openstack | 0:1.9.1-17.1.20260318160829.0e9a6f2.el9ost |
| Red Hat openstack 17.1 | collectd-sensubility | 0:0.2.1-6.el9ost |
| Red Hat openstack 17.1 | collectd-sensubility-debuginfo | 0:0.2.1-6.el9ost |
| Red Hat openstack 17.1 | erlang | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-asn1 | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-asn1-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-compiler | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-crypto | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-crypto-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-debugsource | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-eldap | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-erl_interface-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-erts | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-erts-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-inets | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-kernel | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-mnesia | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-odbc-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-os_mon | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-os_mon-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-parsetools | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-public_key | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-runtime_tools | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-runtime_tools-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-sasl | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-snmp | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-ssl | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-stdlib | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-syntax_tools | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-tools | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-tools-debuginfo | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | erlang-xmerl | 0:24.3.4.2-7.el9ost |
| Red Hat openstack 17.1 | etcd | 0:3.4.26-9.6.el9ost |
| Red Hat openstack 17.1 | etcd-debuginfo | 0:3.4.26-9.6.el9ost |
| Red Hat openstack 17.1 | etcd-debugsource | 0:3.4.26-9.6.el9ost |
| Red Hat openstack 17.1 | octavia-amphora-image-fips-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | octavia-amphora-image-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | openstack-cinder | 1:18.2.2-17.1.20260702111621.f6b44fc.el9ost |
| Red Hat openstack 17.1 | openstack-dashboard | 1:19.4.1-17.1.20260630130603.9b1a13e.el9ost |
| Red Hat openstack 17.1 | openstack-heat | 1:16.1.1-17.1.20260713101101.edc6d60.el9ost |
| Red Hat openstack 17.1 | openstack-heat-api | 1:16.1.1-17.1.20260713101101.edc6d60.el9ost |
| Red Hat openstack 17.1 | openstack-heat-api-cfn | 1:16.1.1-17.1.20260713101101.edc6d60.el9ost |
| Red Hat openstack 17.1 | openstack-heat-common | 1:16.1.1-17.1.20260713101101.edc6d60.el9ost |
| Red Hat openstack 17.1 | openstack-heat-engine | 1:16.1.1-17.1.20260713101101.edc6d60.el9ost |
| Red Hat openstack 17.1 | openstack-heat-monolith | 1:16.1.1-17.1.20260713101101.edc6d60.el9ost |
| Red Hat openstack 17.1 | openstack-ironic | 1:17.1.1-17.1.20260721220909.c31db88.el9ost |
| Red Hat openstack 17.1 | openstack-ironic-api | 1:17.1.1-17.1.20260721220909.c31db88.el9ost |
| Red Hat openstack 17.1 | openstack-ironic-common | 1:17.1.1-17.1.20260721220909.c31db88.el9ost |
| Red Hat openstack 17.1 | openstack-ironic-conductor | 1:17.1.1-17.1.20260721220909.c31db88.el9ost |
| Red Hat openstack 17.1 | openstack-ironic-python-agent | 0:7.1.1-17.1.20260803104219.0211fa9.el9ost |
| Red Hat openstack 17.1 | openstack-keystone | 1:19.0.2-17.1.20260630150819.54dd95d.el9ost |
| Red Hat openstack 17.1 | openstack-neutron | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-common | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-linuxbridge | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-macvtap-agent | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-metering-agent | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-ml2 | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-openvswitch | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-ovn-metadata-agent | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-ovn-migration-tool | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-rpc-server | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-neutron-sriov-nic-agent | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | openstack-nova | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-api | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-common | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-compute | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-conductor | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-migration | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-novncproxy | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-scheduler | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-serialproxy | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-nova-spicehtml5proxy | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | openstack-selinux | 0:0.8.37-17.1.20260107141051.05dd1b2.el9ost |
| Red Hat openstack 17.1 | openstack-swift | 0:2.27.1-17.1.20260806131309.16dbcae.el9ost |
| Red Hat openstack 17.1 | openstack-swift-account | 0:2.27.1-17.1.20260806131309.16dbcae.el9ost |
| Red Hat openstack 17.1 | openstack-swift-container | 0:2.27.1-17.1.20260806131309.16dbcae.el9ost |
| Red Hat openstack 17.1 | openstack-swift-object | 0:2.27.1-17.1.20260806131309.16dbcae.el9ost |
| Red Hat openstack 17.1 | openstack-swift-proxy | 0:2.27.1-17.1.20260806131309.16dbcae.el9ost |
| Red Hat openstack 17.1 | openstack-tripleo-heat-templates | 0:14.3.1-17.1.20260803105013.e7c7ce3.el9ost |
| Red Hat openstack 17.1 | os-net-config | 0:14.2.1-17.1.20260803103231.61d7bd7.el9ost |
| Red Hat openstack 17.1 | puppet-rabbitmq | 0:11.0.1-17.1.20260306080955.63fee2c.el9ost |
| Red Hat openstack 17.1 | puppet-tripleo | 0:14.2.3-17.1.20260206090839.40278e1.el9ost |
| Red Hat openstack 17.1 | python-cinder-tests-tempest | 0:1.8.0-17.1.20260114160833.0e94611.el9ost |
| Red Hat openstack 17.1 | python-django-horizon | 1:19.4.1-17.1.20260630130603.9b1a13e.el9ost |
| Red Hat openstack 17.1 | python-glance-store | 0:2.5.1-17.1.20260225150839.5f1cee6.el9ost |
| Red Hat openstack 17.1 | python-os-brick | 0:4.3.4-17.1.20260324150947.cf69f92.el9ost |
| Red Hat openstack 17.1 | python-oslo-messaging | 0:12.7.3-17.1.20260701150916.5d6fd1a.el9ost |
| Red Hat openstack 17.1 | python-oslo-serialization | 0:4.1.1-17.1.20260326121047.bbe5d5a.el9ost |
| Red Hat openstack 17.1 | python-ovsdbapp | 0:1.9.4-17.1.20260304101059.65d02f0.el9ost |
| Red Hat openstack 17.1 | python3-cinder | 1:18.2.2-17.1.20260702111621.f6b44fc.el9ost |
| Red Hat openstack 17.1 | python3-cinder-common | 1:18.2.2-17.1.20260702111621.f6b44fc.el9ost |
| Red Hat openstack 17.1 | python3-cinder-tests-tempest | 0:1.8.0-17.1.20260114160833.0e94611.el9ost |
| Red Hat openstack 17.1 | python3-django-horizon | 1:19.4.1-17.1.20260630130603.9b1a13e.el9ost |
| Red Hat openstack 17.1 | python3-glance-store | 0:2.5.1-17.1.20260225150839.5f1cee6.el9ost |
| Red Hat openstack 17.1 | python3-ironic-python-agent | 0:7.1.1-17.1.20260803104219.0211fa9.el9ost |
| Red Hat openstack 17.1 | python3-keystone | 1:19.0.2-17.1.20260630150819.54dd95d.el9ost |
| Red Hat openstack 17.1 | python3-neutron | 1:18.6.1-17.1.20260810120959.85ff760.el9ost |
| Red Hat openstack 17.1 | python3-nova | 1:23.2.3-17.1.20260810140853.2ace99d.el9ost |
| Red Hat openstack 17.1 | python3-os-brick | 0:4.3.4-17.1.20260324150947.cf69f92.el9ost |
| Red Hat openstack 17.1 | python3-oslo-messaging | 0:12.7.3-17.1.20260701150916.5d6fd1a.el9ost |
| Red Hat openstack 17.1 | python3-oslo-serialization | 0:4.1.1-17.1.20260326121047.bbe5d5a.el9ost |
| Red Hat openstack 17.1 | python3-ovsdbapp | 0:1.9.4-17.1.20260304101059.65d02f0.el9ost |
| Red Hat openstack 17.1 | python3-swift | 0:2.27.1-17.1.20260806131309.16dbcae.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-all | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-base | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-fips-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-ipa-fips-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-ipa-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-metadata | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-minimal | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-minimal-fips | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-multirhel-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-uefi-fips-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-uefi-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | rhosp-director-images-x86_64 | 0:17.1-20260901.1.el9ost |
| Red Hat openstack 17.1 | tripleo-ansible | 0:3.3.1-17.1.20260603190918.8debef3.el9ost |
| Red Hat openstack 18.0 | openstack-nova | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-api | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-common | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-compute | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-conductor | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-migration | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-novncproxy | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-scheduler | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-serialproxy | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | openstack-nova-spicehtml5proxy | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Red Hat openstack 18.0 | python3-nova | 1:27.5.2-18.0.20260312122217.c1c6d67.el9ost |
| Ubuntu 22.04 LTS | nova | 3:25.2.1-0ubuntu2.10 |
| Ubuntu 24.04 LTS | nova | 3:29.2.0-0ubuntu1.3 |
| Ubuntu 25.10 | nova | 3:32.0.0-0ubuntu1.1 |
| Ubuntu Pro 16.04 LTS | nova | no fix |
| Ubuntu Pro 18.04 LTS | nova | no fix |
| Ubuntu Pro 20.04 LTS | nova | no fix |