Vulnerability record · CVE-2012-3371 · published 17 July 2012

CVE-2012-3371: Openstack compute improper input validation vulnerability

Openstack · Compute

The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section.

3.5 CVSS 2.0 Low EPSS 1.9% · top 21.6% CWE-20 · Improper input validation

3.5CVSS 2.0 base score

1.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

3Affected product versions listed by NVD

12References, 4 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:S/C:N/I:N/A:P

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Compute Openstack

Essex Openstack

Folsom Openstack

References

Link	Tags
http://www.openwall.com/lists/oss-security/2012/07/11/13
http://www.securityfocus.com/bid/54388
http://www.ubuntu.com/usn/USN-1501-1
https://bugs.launchpad.net/nova/+bug/1017795	Exploit
https://github.com/openstack/nova/commit/034762e8060dcf0a11cb039b9d426b0d0bb1801d	ExploitPatch
https://lists.launchpad.net/openstack/msg14452.html
http://www.openwall.com/lists/oss-security/2012/07/11/13
http://www.securityfocus.com/bid/54388
http://www.ubuntu.com/usn/USN-1501-1
https://bugs.launchpad.net/nova/+bug/1017795	Exploit
https://github.com/openstack/nova/commit/034762e8060dcf0a11cb039b9d426b0d0bb1801d	ExploitPatch
https://lists.launchpad.net/openstack/msg14452.html

Track CVE-2012-3371 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2013-0261Openstack essex link following vulnerabilityA flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This …EPSS 0.34%8 Mar 2013 7.6CVE-2013-0335Openstack essex insufficient session expiration vulnerabilityOpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circu…EPSS 2.1%22 Mar 2013 7.5CVE-2013-2161Openstack folsom code injection vulnerabilityXML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift r…EPSS 1.9%20 Aug 2013 7.1CVE-2013-7130Openstack compute information exposure vulnerabilityThe i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, w…EPSS 2.4%6 Feb 2014 6.8CVE-2013-1865Openstack folsom improper authentication vulnerabilityOpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remot…EPSS 2.6%22 Mar 2013 6.5CVE-2013-0208Openstack essex permissions and access controls vulnerabilityThe boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from ot…EPSS 2.5%13 Feb 2013 6.4CVE-2013-4497Openstack havana permissions and access controls vulnerabilityThe XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an…EPSS 1.8%5 Nov 2013 6.0CVE-2014-0167Openstack compute permissions and access controls vulnerabilityThe Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce R…EPSS 1.6%15 Apr 2014

Source: NIST National Vulnerability Database (record CVE-2012-3371), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.