CVE-2022-3277: openstack-neutron uncontrolled resource consumption flaw

CVE-2022-3277 PUBLISHED CVSS 6.5 MEDIUM

openstack-neutron uncontrolled resource consumption flaw

Reported by redhat · Published March 6, 2023

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
neutron	openstack	19.5.0, 18.6.0

Risk scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
n/a	openstack-neutron	As shipped with Red Hat Openstack 13, 16.1, and 16.2
n/a	openstack-neutron	As shipped with Red Hat Openstack 13, 16.1, and 16.2
PyPI	neutron	19.0.0.0rc1, 0, 20.0.0.0rc1

Timeline

Dec 7, 2022 CVE Published
Mar 7, 2023 EPSS Score (30 in total, the first dated here)
May 18, 2025 CVE Updated
Mar 9, 2026 Security Advisory (19 in total, the first dated here)
Mar 20, 2026 Distribution Patch (17 in total, the first dated here)
Jun 24, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2022-3277
vulnetix vdb fixes CVE-2022-3277

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-3277/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →