CVE-2023-3637
Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
CVE-2023-3637- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2023-2132
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
EUVD-2023-2132- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r3jh-qhgj-gvr8
Denial of service in neutron
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
GHSA-r3jh-qhgj-gvr8- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
CVE-2023-3637- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-r3jh-qhgj-gvr8
Denial of service in neutron
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
GHSA-r3jh-qhgj-gvr8- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVPYSEC-2026-1694
Denial of service in neutron
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
PYSEC-2026-1694- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2023:4283
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-neutron) security update
- Record
RHSA-2023:4283- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-3637
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.
- Record
UBUNTU-CVE-2023-3637- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neutronPyPI |
through 22.0.2 | None known |
neutronPyPI |
through 22.0.2, plus listed versions 0.010.0.510.0.610.0.711.0.3 Show 45 moreShow less11.0.411.0.511.0.611.0.711.0.812.0.012.0.0.0b312.0.0.0rc112.0.0.0rc212.0.112.0.212.0.312.0.412.0.512.0.612.1.012.1.113.0.013.0.0.0b113.0.0.0b213.0.0.0b313.0.0.0rc113.0.0.0rc213.0.113.0.213.0.313.0.413.0.513.0.613.0.714.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.114.0.214.0.314.0.414.1.014.2.014.3.014.3.114.4.014.4.1 |
None known |
openstack-neutronRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-commonRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-linuxbridgeRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-macvtap-agentRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-metering-agentRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-ml2Red Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-openvswitchRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
openstack-neutron-rpc-serverRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-neutron-sriov-nic-agentRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
python3-neutronRed Hat:openstack:16.2::el8 |
before 1:15.3.5-2.20230216175503.el8ost | 1:15.3.5-2.20230216175503.el8ost |
neutronUbuntu:16.04:LTS |
All versions, plus listed versions 2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu22:8.0.0~b2-0ubuntu42:8.0.0~b2-0ubuntu52:8.0.0~b2-0ubuntu7 Show 20 moreShow less2:8.0.0~b3-0ubuntu12:8.0.0~rc1-0ubuntu12:8.0.0-0ubuntu12:8.1.0-0ubuntu0.16.04.22:8.1.2-0ubuntu12:8.2.0-0ubuntu12:8.3.0-0ubuntu12:8.3.0-0ubuntu1.12:8.3.0-0ubuntu1.22:8.4.0-0ubuntu12:8.4.0-0ubuntu22:8.4.0-0ubuntu32:8.4.0-0ubuntu42:8.4.0-0ubuntu52:8.4.0-0ubuntu62:8.4.0-0ubuntu7.12:8.4.0-0ubuntu7.22:8.4.0-0ubuntu7.32:8.4.0-0ubuntu7.42:8.4.0-0ubuntu7.5 |
None known |
neutronUbuntu:18.04:LTS |
All versions, plus listed versions 2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1 Show 27 moreShow less2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu82:12.1.1-0ubuntu8.1 |
None known |
neutronUbuntu:20.04:LTS |
All versions, plus listed versions 2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1 Show 31 moreShow less2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.12:16.4.2-0ubuntu6.22:16.4.2-0ubuntu6.32:16.4.2-0ubuntu6.4 |
None known |
neutronUbuntu:22.04:LTS |
All versions, plus listed versions 2:19.0.0-0ubuntu12:19.1.0+git2022030313.b072cbf05f-0ubuntu12:20.0.0-0ubuntu12:20.0.0-0ubuntu22:20.0.0-0ubuntu3 Show 9 moreShow less2:20.1.0-0ubuntu22:20.2.0-0ubuntu12:20.3.0-0ubuntu12:20.3.0-0ubuntu1.12:20.3.1-0ubuntu12:20.4.0-0ubuntu12:20.5.0-0ubuntu12:20.5.0-0ubuntu22:20.5.0-0ubuntu2.1 |
None known |
neutronUbuntu:24.04:LTS |
All versions, plus listed versions 2:23.0.0-0ubuntu12:24.0.0~b1+git2024011914.5ce17647-0ubuntu12:24.0.0~rc1-0ubuntu22:24.0.0-0ubuntu12:24.0.0-0ubuntu2 Show 4 moreShow less2:24.1.0-0ubuntu12:24.1.0-0ubuntu1.12:24.1.0-0ubuntu1.22:24.2.2-0ubuntu0.24.04.1 |
None known |
neutronUbuntu:25.10 |
All versions, plus listed versions 2:26.0.0-0ubuntu12:26.0.1+git2025070714.71962255de-0ubuntu12:26.0.1+git2025070714.71962255de-0ubuntu22:27.0.0~rc1-0ubuntu12:27.0.0-0ubuntu12:27.0.0-0ubuntu1.1 |
None known |
neutronUbuntu:26.10 |
All versions, plus listed versions 2:28.0.0-0ubuntu12:28.0.0-0ubuntu22:29.0.0~b1+git20260818.132.9aaa6fa-0ubuntu12:29.0.0~rc1-0ubuntu12:29.0.0-0ubuntu1 |
None known |
neutronUbuntu:26.04:LTS |
All versions, plus listed versions 2:27.0.0-0ubuntu12:28.0.0~b2+git20260121.28.762694d1bd-0ubuntu12:28.0.0~rc1-0ubuntu12:28.0.0~rc2-0ubuntu12:28.0.0-0ubuntu12:28.0.0-0ubuntu1.12:28.0.2-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3637 is a medium vulnerability (CVSS 4.3) in Red Hat Openstack Platform 13 (queens) Operational Tools, published July 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in openstack-neutron 1:15.3.5-2.20230216175503.el8ost.
References
Left out here: 78 versions. The JSON record has them.