Every CVE Search/ Get API key

CVE-2022-3277

openstack-neutron uncontrolled resource consumption flaw

6.5 MediumFix available

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.06%Up 1.0 points since Mar 7, 2023
90%50%10%1%

What each source reports

NVD Score used 6.5

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
CVE-2022-3277
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
CVE List 6.5

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
CVE-2022-3277
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2023-1125 6.5

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
EUVD-2023-1125
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-w446-h7vg-wv3p 6.5

openstack-neutron uncontrolled resource consumption flaw

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
GHSA-w446-h7vg-wv3p
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 6.5

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
CVE-2022-3277
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVGHSA-w446-h7vg-wv3p 6.5

openstack-neutron uncontrolled resource consumption flaw

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
GHSA-w446-h7vg-wv3p
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
Show 7 moreShow less
OSVPYSEC-2026-855 6.5

openstack-neutron uncontrolled resource consumption flaw

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
PYSEC-2026-855
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:8855 4.3

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (openstack-neutron) security update

Record
RHSA-2022:8855
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2022:8870 4.3

Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-neutron) security update

Record
RHSA-2022:8870
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2023:0275 4.3

Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-neutron) security update

Record
RHSA-2023:0275
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2022-3277 6.5

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
UBUNTU-CVE-2022-3277
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-3277 No score

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Record
DEBIAN-CVE-2022-3277
Updated
2026-11-03
OSVUSN-6067-1 No score

neutron vulnerabilities

David Sinquin discovered that OpenStack Neutron incorrectly handled the default Open vSwitch firewall rules. An attacker could possibly use this issue to impersonate the IPv6 addresses of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-20267)

Jake Yip and Justin Mammarella discovered that OpenStack Neutron incorrectly handled the linuxbridge driver when ebtables-nft is being used. An attacker could possibly use this issue to impersonate the hardware addresss of other systems on the network. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-38598)

Pavel Toporkov discovered that OpenStack Neutron incorrectly handled extra_dhcp_opts values. An attacker could possibly use this issue to reconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40085)

Slawek Kaplonski discovered that OpenStack Neutron incorrectly handled the routes middleware. An attacker could possibly use this issue to cause the API worker to consume memory, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)

It was discovered that OpenStack Neutron incorrectly handled certain queries. A remote authenticated user could possibly use this issue to cause resource consumption, leading to a denial of service. (CVE-2022-3277)

Record
USN-6067-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
neutron
PyPI
 19.0.0.0rc1 up to 19.5.0
19.5.0
neutron
PyPI
 before 18.6.0
18.6.0
neutron
PyPI
 20.0.0.0rc1 up to 20.3.0
20.3.0
neutron
Debian:12
 before 2:21.0.0~rc1-3
2:21.0.0~rc1-3
neutron
Debian:13
 before 2:21.0.0~rc1-3
2:21.0.0~rc1-3
neutron
Debian:14
 before 2:21.0.0~rc1-3
2:21.0.0~rc1-3
neutron
PyPI
 19.0.0.0rc1 up to 19.5.0, plus listed versions
19.0.019.0.0.0rc219.1.019.2.019.3.019.4.0
19.5.0
neutron
PyPI
 before 18.6.0, plus listed versions
0.010.0.510.0.610.0.711.0.3
Show 45 moreShow less
11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1
18.6.0
neutron
PyPI
 20.0.0.0rc1 up to 20.3.0, plus listed versions
20.0.020.0.0.0rc220.1.020.2.0
20.3.0
neutron
PyPI
 before 18.6.0, 19.0.0.0rc1 up to 19.5.0, 20.0.0.0rc1 up to 20.3.0, plus listed versions
0.010.0.510.0.610.0.711.0.3
Show 45 moreShow less
11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1
18.6.019.5.020.3.0
Show 28 moreShow less
Affected packages
PackageAffectedFixed
openstack-neutron
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-common
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-linuxbridge
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-macvtap-agent
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-metering-agent
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-ml2
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-openvswitch
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-rpc-server
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron-sriov-nic-agent
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
python3-neutron
Red Hat:openstack:16.2::el8
 before 1:15.3.5-2.20221005184727.c81fb5b.el8ost
1:15.3.5-2.20221005184727.c81fb5b.el8ost
openstack-neutron
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-common
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-linuxbridge
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-macvtap-agent
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-metering-agent
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-ml2
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-openvswitch
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-rpc-server
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron-sriov-nic-agent
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
python3-neutron
Red Hat:openstack:16.1::el8
 before 1:15.2.1-1.20221005123225.40d217c.el8ost
1:15.2.1-1.20221005123225.40d217c.el8ost
openstack-neutron
Red Hat:openstack:17.0::el9
 before 1:18.4.1-0.20221128170741.5258354.el9ost
1:18.4.1-0.20221128170741.5258354.el9ost
neutron
Ubuntu:16.04:LTS
 All versions, plus listed versions
2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu22:8.0.0~b2-0ubuntu42:8.0.0~b2-0ubuntu52:8.0.0~b2-0ubuntu7
Show 20 moreShow less
2:8.0.0~b3-0ubuntu12:8.0.0~rc1-0ubuntu12:8.0.0-0ubuntu12:8.1.0-0ubuntu0.16.04.22:8.1.2-0ubuntu12:8.2.0-0ubuntu12:8.3.0-0ubuntu12:8.3.0-0ubuntu1.12:8.3.0-0ubuntu1.22:8.4.0-0ubuntu12:8.4.0-0ubuntu22:8.4.0-0ubuntu32:8.4.0-0ubuntu42:8.4.0-0ubuntu52:8.4.0-0ubuntu62:8.4.0-0ubuntu7.12:8.4.0-0ubuntu7.22:8.4.0-0ubuntu7.32:8.4.0-0ubuntu7.42:8.4.0-0ubuntu7.5
 None known
neutron
Ubuntu:18.04:LTS
 before 2:12.1.1-0ubuntu8.1, plus listed versions
2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1
Show 26 moreShow less
2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu8
2:12.1.1-0ubuntu8.1
neutron
Ubuntu:20.04:LTS
 before 2:16.4.2-0ubuntu6.2, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
Show 28 moreShow less
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.1
2:16.4.2-0ubuntu6.2
neutron
Ubuntu:22.04:LTS
 before 2:20.3.0-0ubuntu1.1, plus listed versions
2:19.0.0-0ubuntu12:19.1.0+git2022030313.b072cbf05f-0ubuntu12:20.0.0-0ubuntu12:20.0.0-0ubuntu22:20.0.0-0ubuntu32:20.1.0-0ubuntu22:20.2.0-0ubuntu12:20.3.0-0ubuntu1
2:20.3.0-0ubuntu1.1
neutron
Ubuntu:18.04:LTS
From an advisory covering 5 CVEs
 before 2:12.1.1-0ubuntu8.1, plus listed versions
2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1
Show 26 moreShow less
2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu8
2:12.1.1-0ubuntu8.1
neutron
Ubuntu:20.04:LTS
From an advisory covering 5 CVEs
 before 2:16.4.2-0ubuntu6.2, plus listed versions
2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
Show 28 moreShow less
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.1
2:16.4.2-0ubuntu6.2
neutron
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 2:20.3.0-0ubuntu1.1, plus listed versions
2:19.0.0-0ubuntu12:19.1.0+git2022030313.b072cbf05f-0ubuntu12:20.0.0-0ubuntu12:20.0.0-0ubuntu22:20.0.0-0ubuntu32:20.1.0-0ubuntu22:20.2.0-0ubuntu12:20.3.0-0ubuntu1
2:20.3.0-0ubuntu1.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3277 is a medium vulnerability (CVSS 6.5) in Openstack Neutron, published March 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in neutron 19.5.0.

References

Show 49 moreShow less
This page doesn't list everything

Left out here: 102 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open