https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 00:47:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-24708 <p><strong>Affected:</strong> OpenStack Nova, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Services on OpenShift 18.0, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0</p> <p>An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova&#39;s Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.</p> <p><strong>Affected:</strong> OpenStack Nova, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat OpenStack Services on OpenShift 18.0, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0</p> <p>An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova&#39;s Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.</p> https://vulnerability.circl.lu/vuln/cve-2026-24708 https://vulnerability.circl.lu/vuln/usn-8049-1 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: nova, Ubuntu:24.04:LTS: nova, Ubuntu:25.10: nova</p> <p>Dan Smith discovered that Nova incorrectly called qemu-img without a format restriction when resizing disks. An attacker could possibly use this issue to destroy data on the host system.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: nova, Ubuntu:24.04:LTS: nova, Ubuntu:25.10: nova</p> <p>Dan Smith discovered that Nova incorrectly called qemu-img without a format restriction when resizing disks. An attacker could possibly use this issue to destroy data on the host system.</p> https://vulnerability.circl.lu/vuln/usn-8049-1