← Vulnerability feed

Vulnerability record · CVE-2022-3277 · published 6 March 2023

CVE-2022-3277: Openstack neutron uncontrolled resource consumption vulnerability

Openstack · Neutron

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

6.5 CVSS 3.1 Medium EPSS 1.1% · top 36.7% CWE-400 · Uncontrolled resource consumption
6.5CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugs.launchpad.net/neutron/+bug/1988026 Issue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=2129193 Issue TrackingPatchVendor Advisory
https://bugs.launchpad.net/neutron/+bug/1988026 Issue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=2129193 Issue TrackingPatchVendor Advisory
https://bugs.launchpad.net/neutron/+bug/1988026 Issue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=2129193 Issue TrackingPatchVendor Advisory

Track CVE-2022-3277 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.9CVE-2020-10731Redhat openstack platform improper access control vulnerabilityA flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw cause…EPSS 0.89%9.1CVE-2021-38598Openstack neutron authentication bypass by spoofing vulnerabilityOpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft i…EPSS 1.2%9.1CVE-2015-8914Openstack neutron vulnerabilityThe IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protect…EPSS 4.3%9.0CVE-2014-0187Openstack neutron permissions and access controls vulnerabilityThe openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass secu…EPSS 2.9%8.6CVE-2022-2132Dpdk data plane development kit vulnerabilityA permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a c…EPSS 2.2%8.2CVE-2023-1668Cloudbase open vswitch vulnerabilityA flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying …EPSS 1.2%8.2CVE-2016-5363Openstack neutron vulnerabilityThe IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection…EPSS 3.3%

Source: NIST National Vulnerability Database (record CVE-2022-3277), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.