CVE-2013-0270

Keystone: openstack keystone: denial of service via large http request with long tenant name

6.5 MediumFix available

CVE-2013-0270 is a medium vulnerability (CVSS 6.5) in Openstack Keystone, published April 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.16%, the 88th percentile. Fixed in keystone 8.0.0a0.

A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.16%Up 1.8 points since Feb 4, 2022

What each source reports

CVE List Score used 6.5

Keystone: openstack keystone: denial of service via large http request with long tenant name

Record: CVE-2013-0270
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1284
Updated: 2026-11-02

EUVDEUVD-2022-2419 6.5

Record: EUVD-2022-2419
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4ppj-4p4v-jf4p 6.5

OpenStack Keystone Denial of Service vulnerability via a large HTTP request

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.

Record: GHSA-4ppj-4p4v-jf4p
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-119, CWE-1284
Updated: 2026-11-02

NVD 6.5

Record: CVE-2013-0270
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-1284, CWE-119
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-0270 6.5

Record: DEBIAN-CVE-2013-0270
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-4ppj-4p4v-jf4p 6.5

OpenStack Keystone Denial of Service vulnerability via a large HTTP request

Record: GHSA-4ppj-4p4v-jf4p
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-119, CWE-1284
Updated: 2026-11-02

OSVPYSEC-2026-650 6.5

OpenStack Keystone Denial of Service vulnerability via a large HTTP request

Record: PYSEC-2026-650
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2013:0708 6.5

Red Hat Security Advisory: openstack-keystone security and bug fix update

Record: RHSA-2013:0708
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

Record: CVE-2013-0270
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`keystone` PyPI	before 8.0.0a0	8.0.0a0
`keystone` Debian:12	before 2013.1.1-2	2013.1.1-2
`keystone` Debian:13	before 2013.1.1-2	2013.1.1-2
`keystone` Debian:14	before 2013.1.1-2	2013.1.1-2
`openstack-keystone` Red Hat:openstack:2::el6	before 0:2012.2.3-7.el6ost	0:2012.2.3-7.el6ost
`openstack-keystone-doc` Red Hat:openstack:2::el6	before 0:2012.2.3-7.el6ost	0:2012.2.3-7.el6ost
`python-keystone` Red Hat:openstack:2::el6	before 0:2012.2.3-7.el6ost	0:2012.2.3-7.el6ost

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 17 moreShow less