Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 9 Sep 2021 14:16:09 +0000
From: Jeremy Stanley <>
Subject: [OSSA-2021-006] Neutron: Routes middleware memory leak for
 nonexistent controllers (CVE-2021-40797)

OSSA-2021-006: Routes middleware memory leak for nonexistent controllers

:Date: September 09, 2021
:CVE: CVE-2021-40797

- Neutron: <16.4.1, >=17.0.0 <17.2.1, >=18.0.0 <18.1.1

Slawek Kaplonski with Red Hat reported a vulnerability in Neutron's
routes middleware. By making API requests involving nonexistent
controllers, an authenticated user may cause the API worker to
consume increasing amounts of memory, resulting in API performance
degradation or denial of service. All Neutron deployments are

- (Queens)
- (Rocky)
- (Stein)
- (Train)
- (Ussuri)
- (Victoria)
- (Wallaby)
- (Xena)

- Slawek Kaplonski from Red Hat (CVE-2021-40797)


- The stable/train, stable/stein, stable/rocky, and stable/queens
  branches are under extended maintenance and will receive no new
  point releases, but patches for them are provided as a courtesy.

Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.