CVE-2026-83536
5.3MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can cause a denial of service by exhausting file descriptors with slow HTTP connections (Slowloris). This halts Prometheus metric collection and alerting for the affected host.
Root cause
The HTTP server lacks timeout configurations like ReadHeaderTimeout, leaving connections open indefinitely while receiving slow headers.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Fix & remediation
Upgrade openstack-network-exporter once a patched release is provided by the vendor. In the interim, restrict network access to the metrics port using firewall rules or a reverse proxy configured with strict request timeouts.
$ rpm -q openstack-network-exporterAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.