Medium severity · published Oct 12, 2026
CVE-2026-83536
Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat OpenStack Platform 18.0 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat OpenStack Platform 18.0
Red Hat
More from Red Hat OpenStack Platform 18.0
9.8
CVE-2026-27459
pyOpenSSL DTLS cookie callback buffer overflow
9.3
CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
8.8
CVE-2026-43000
An issue was discovered in OpenStack Keystone before 29.0.2
8.8
CVE-2026-42999
An issue was discovered in OpenStack Keystone before 29.0.2
8.5
CVE-2026-92982
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection