Every CVE Search/ Get API key

CVE-2014-5356

OpenStack Glance improper validation of the image_size_cap configuration option

4.0 MediumFix available

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Exploit likelihood

2.15%Up 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
CVE-2014-5356
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
CVE-2014-5356
Updated
2026-11-02
EUVDEUVD-2022-2324 No score

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
EUVD-2022-2324
Updated
2026-11-03
GitHub AdvisoriesGHSA-479j-jf2p-38pg No score

OpenStack Glance improper validation of the image_size_cap configuration option

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
GHSA-479j-jf2p-38pg
Updated
2026-11-02
OSV No score

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
CVE-2014-5356
Updated
2026-11-02
OSVDEBIAN-CVE-2014-5356 No score

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
DEBIAN-CVE-2014-5356
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-479j-jf2p-38pg No score

OpenStack Glance improper validation of the image_size_cap configuration option

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
GHSA-479j-jf2p-38pg
Updated
2026-11-02
OSVPYSEC-2026-810 No score

OpenStack Glance improper validation of the image_size_cap configuration option

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
PYSEC-2026-810
Updated
2026-11-02
OSVUBUNTU-CVE-2014-5356 No score

OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.

Record
UBUNTU-CVE-2014-5356
Updated
2026-11-02
OSVUSN-2322-1 No score

glance vulnerability

Thomas Leaman and Stuart McLaren discovered that OpenStack Glance did not properly honor the image_size_cap configuration option. A remote authenticated attacker could exploit this to cause a denial of service via disk consumption.

Record
USN-2322-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glance
PyPI
 before 11.0.0a0
11.0.0a0
glance
Debian:12
 before 2014.1.3-1
2014.1.3-1
glance
Debian:13
 before 2014.1.3-1
2014.1.3-1
glance
Debian:14
 before 2014.1.3-1
2014.1.3-1
openstack-glance
Red Hat:openstack:5::el7
 before 0:2014.1.2-3.el7ost
0:2014.1.2-3.el7ost
openstack-glance-doc
Red Hat:openstack:5::el7
 before 0:2014.1.2-3.el7ost
0:2014.1.2-3.el7ost
python-glance
Red Hat:openstack:5::el7
 before 0:2014.1.2-3.el7ost
0:2014.1.2-3.el7ost
openstack-glance
Red Hat:openstack:5::el6
 before 0:2014.1.2-5.el6ost
0:2014.1.2-5.el6ost
openstack-glance-doc
Red Hat:openstack:5::el6
 before 0:2014.1.2-5.el6ost
0:2014.1.2-5.el6ost
python-glance
Red Hat:openstack:5::el6
 before 0:2014.1.2-5.el6ost
0:2014.1.2-5.el6ost
Show 4 moreShow less
Affected packages
PackageAffectedFixed
openstack-glance
Red Hat:openstack:4::el6
 before 0:2013.2.4-1.el6ost
0:2013.2.4-1.el6ost
openstack-glance-doc
Red Hat:openstack:4::el6
 before 0:2013.2.4-1.el6ost
0:2013.2.4-1.el6ost
python-glance
Red Hat:openstack:4::el6
 before 0:2013.2.4-1.el6ost
0:2013.2.4-1.el6ost
glance
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc2-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b3-0ubuntu2
Show 5 moreShow less
1:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu21:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-5356 is a medium vulnerability (CVSS 4.0) in Canonical Ubuntu Linux, published August 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. Fixed in glance 11.0.0a0.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open