{"id":"CVE-2021-40797","aliases":["DEBIAN-CVE-2021-40797","EUVD-2021-0143","GHSA-cpx3-696p-3cw9","PYSEC-2021-329","RHSA-2022:0990","RHSA-2022:0996","SUSE-SU-2022:1884-1","UBUNTU-CVE-2021-40797","USN-6067-1"],"status":"published","title":"OpenStack Neutron Denial of Service vulnerability","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01809,"percentile":0.78911,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-772"],"published":"2021-09-08T19:11:40Z","modified":"2026-10-24T10:30:41Z","fixes":[{"ecosystem":"PyPI","package":"neutron","fixed_in":["16.4.1","17.2.1","18.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"neutron","fixed_in":["2:19.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"neutron","fixed_in":["2:19.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"neutron","fixed_in":["2:19.0.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-common","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-linuxbridge","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-macvtap-agent","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-metering-agent","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-ml2","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-openvswitch","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-rpc-server","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-sriov-nic-agent","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-neutron","fixed_in":["1:15.2.1-1.20220112133420.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-common","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-linuxbridge","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-macvtap-agent","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-metering-agent","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-ml2","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-openvswitch","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-rpc-server","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-sriov-nic-agent","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-neutron","fixed_in":["1:15.3.5-2.20220113150031.el8ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"neutron","fixed_in":["2:12.1.1-0ubuntu8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"neutron","fixed_in":["2:16.4.2-0ubuntu6.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.4.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0"},{"fixed":"17.2.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"18.1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:19.0.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.4.1"}]}],"versions":["0.0","10.0.5","10.0.6","10.0.7","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","12.0.0","12.0.0.0b3","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.1.0","12.1.1","13.0.0","13.0.0.0b1","13.0.0.0b2","13.0.0.0b3","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.0.3","13.0.4","13.0.5","13.0.6","13.0.7","14.0.0","14.0.0.0b1","14.0.0.0b2","14.0.0.0b3","14.0.0.0rc1","14.0.1","14.0.2","14.0.3","14.0.4","14.1.0","14.2.0","14.3.0","14.3.1","14.4.0","14.4.1","14.4.2","15.0.0","15.0.0.0b1","15.0.0.0rc1","15.0.0.0rc2","15.0.1","15.0.2","15.1.0","15.2.0","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","16.0.0","16.0.0.0b1","16.0.0.0rc1","16.0.0.0rc2","16.1.0","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0"},{"fixed":"17.2.1"}]}],"versions":["17.0.0","17.1.0","17.1.1","17.1.2","17.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"18.1.1"}]}],"versions":["18.0.0","18.1.0"]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.4.1"},{"introduced":"17.0.0"},{"fixed":"17.2.1"},{"introduced":"18.0.0"},{"fixed":"18.1.1"}]}],"versions":["0.0","10.0.5","10.0.6","10.0.7","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","12.0.0","12.0.0.0b3","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.1.0","12.1.1","13.0.0","13.0.0.0b1","13.0.0.0b2","13.0.0.0b3","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.0.3","13.0.4","13.0.5","13.0.6","13.0.7","14.0.0","14.0.0.0b1","14.0.0.0b2","14.0.0.0b3","14.0.0.0rc1","14.0.1","14.0.2","14.0.3","14.0.4","14.1.0","14.2.0","14.3.0","14.3.1","14.4.0","14.4.1","14.4.2","15.0.0","15.0.0.0b1","15.0.0.0rc1","15.0.0.0rc2","15.0.1","15.0.2","15.1.0","15.2.0","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","16.0.0","16.0.0.0b1","16.0.0.0rc1","16.0.0.0rc2","16.1.0","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","17.0.0","17.1.0","17.1.1","17.1.2","17.2.0","18.0.0","18.1.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-linuxbridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-macvtap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-metering-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-ml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-rpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-sriov-nic-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20220112133420.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-linuxbridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-macvtap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-metering-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-ml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-rpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-sriov-nic-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20220113150031.el8ost"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9~dev69-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.0.0-0ubuntu1","2:8.0.0~b1-0ubuntu2","2:8.0.0~b2-0ubuntu4","2:8.0.0~b2-0ubuntu5","2:8.0.0~b2-0ubuntu7","2:8.0.0~b3-0ubuntu1","2:8.0.0~rc1-0ubuntu1","2:8.0.0-0ubuntu1","2:8.1.0-0ubuntu0.16.04.2","2:8.1.2-0ubuntu1","2:8.2.0-0ubuntu1","2:8.3.0-0ubuntu1","2:8.3.0-0ubuntu1.1","2:8.3.0-0ubuntu1.2","2:8.4.0-0ubuntu1","2:8.4.0-0ubuntu2","2:8.4.0-0ubuntu3","2:8.4.0-0ubuntu4","2:8.4.0-0ubuntu5","2:8.4.0-0ubuntu6","2:8.4.0-0ubuntu7.1","2:8.4.0-0ubuntu7.2","2:8.4.0-0ubuntu7.3","2:8.4.0-0ubuntu7.4","2:8.4.0-0ubuntu7.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.1.1-0ubuntu8.1"}]}],"versions":["2:11.0.1-0ubuntu1","2:12.0.0~b1-0ubuntu1","2:12.0.0~b1-0ubuntu2","2:12.0.0~b2-0ubuntu1","2:12.0.0~b3-0ubuntu1","2:12.0.0~rc1-0ubuntu1","2:12.0.0~rc2-0ubuntu1","2:12.0.0-0ubuntu1","2:12.0.0-0ubuntu1.1","2:12.0.0-0ubuntu1.2","2:12.0.0-0ubuntu1.3","2:12.0.0-0ubuntu1.4","2:12.0.0-0ubuntu2","2:12.0.0-0ubuntu3","2:12.0.1-0ubuntu1","2:12.0.1-0ubuntu1.1","2:12.0.2-0ubuntu1","2:12.0.3-0ubuntu1","2:12.0.5-0ubuntu1","2:12.0.5-0ubuntu4","2:12.0.5-0ubuntu5","2:12.0.6-0ubuntu1","2:12.0.6-0ubuntu2","2:12.0.6-0ubuntu3","2:12.1.0-0ubuntu1","2:12.1.1-0ubuntu1","2:12.1.1-0ubuntu2","2:12.1.1-0ubuntu3","2:12.1.1-0ubuntu4","2:12.1.1-0ubuntu7","2:12.1.1-0ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.4.2-0ubuntu6.2"}]}],"versions":["2:15.0.0-0ubuntu1","2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4","2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2","2:16.0.0-0ubuntu0.20.04.1","2:16.0.0-0ubuntu0.20.04.2","2:16.1.0-0ubuntu1","2:16.1.0-0ubuntu2","2:16.2.0-0ubuntu1","2:16.2.0-0ubuntu2","2:16.2.0-0ubuntu3","2:16.3.0-0ubuntu3","2:16.3.1-0ubuntu1","2:16.3.1-0ubuntu1.1","2:16.3.2-0ubuntu2","2:16.3.2-0ubuntu3","2:16.4.0-0ubuntu2","2:16.4.0-0ubuntu3","2:16.4.1-0ubuntu2","2:16.4.2-0ubuntu1","2:16.4.2-0ubuntu2","2:16.4.2-0ubuntu3","2:16.4.2-0ubuntu4","2:16.4.2-0ubuntu5","2:16.4.2-0ubuntu6","2:16.4.2-0ubuntu6.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.1.1-0ubuntu8.1"}]}],"versions":["2:11.0.1-0ubuntu1","2:12.0.0~b1-0ubuntu1","2:12.0.0~b1-0ubuntu2","2:12.0.0~b2-0ubuntu1","2:12.0.0~b3-0ubuntu1","2:12.0.0~rc1-0ubuntu1","2:12.0.0~rc2-0ubuntu1","2:12.0.0-0ubuntu1","2:12.0.0-0ubuntu1.1","2:12.0.0-0ubuntu1.2","2:12.0.0-0ubuntu1.3","2:12.0.0-0ubuntu1.4","2:12.0.0-0ubuntu2","2:12.0.0-0ubuntu3","2:12.0.1-0ubuntu1","2:12.0.1-0ubuntu1.1","2:12.0.2-0ubuntu1","2:12.0.3-0ubuntu1","2:12.0.5-0ubuntu1","2:12.0.5-0ubuntu4","2:12.0.5-0ubuntu5","2:12.0.6-0ubuntu1","2:12.0.6-0ubuntu2","2:12.0.6-0ubuntu3","2:12.1.0-0ubuntu1","2:12.1.1-0ubuntu1","2:12.1.1-0ubuntu2","2:12.1.1-0ubuntu3","2:12.1.1-0ubuntu4","2:12.1.1-0ubuntu7","2:12.1.1-0ubuntu8"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.4.2-0ubuntu6.2"}]}],"versions":["2:15.0.0-0ubuntu1","2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4","2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2","2:16.0.0-0ubuntu0.20.04.1","2:16.0.0-0ubuntu0.20.04.2","2:16.1.0-0ubuntu1","2:16.1.0-0ubuntu2","2:16.2.0-0ubuntu1","2:16.2.0-0ubuntu2","2:16.2.0-0ubuntu3","2:16.3.0-0ubuntu3","2:16.3.1-0ubuntu1","2:16.3.1-0ubuntu1.1","2:16.3.2-0ubuntu2","2:16.3.2-0ubuntu3","2:16.4.0-0ubuntu2","2:16.4.0-0ubuntu3","2:16.4.1-0ubuntu2","2:16.4.2-0ubuntu1","2:16.4.2-0ubuntu2","2:16.4.2-0ubuntu3","2:16.4.2-0ubuntu4","2:16.4.2-0ubuntu5","2:16.4.2-0ubuntu6","2:16.4.2-0ubuntu6.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:20.3.0-0ubuntu1.1"}]}],"versions":["2:19.0.0-0ubuntu1","2:19.1.0+git2022030313.b072cbf05f-0ubuntu1","2:20.0.0-0ubuntu1","2:20.0.0-0ubuntu2","2:20.0.0-0ubuntu3","2:20.1.0-0ubuntu2","2:20.2.0-0ubuntu1","2:20.3.0-0ubuntu1"],"bundled":5}],"products":[{"vendor":"openstack","product":"neutron"}],"references":[{"url":"https://launchpad.net/bugs/1942179","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://security.openstack.org/ossa/OSSA-2021-006.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/09/09/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40797","tags":["advisory"]},{"url":"https://github.com/openstack/neutron/commit/e610a5eb9e71aa2549fb11e2139370d227787da2","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-329.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cpx3-696p-3cw9","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-40797","tags":["advisory"]},{"url":"https://github.com/openstack/neutron","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0990","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1963903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1997610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049807","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0990.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-40797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40797","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0996","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1880440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1969349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031881","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0996.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221884-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189794","tags":["report"]},{"url":"https://bugzilla.suse.com/1190339","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40797","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-40797","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6067-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-20267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3277","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-40797","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T19:11:40Z","modified":"2024-08-04T02:51:07.481Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-0143","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T19:11:40Z","modified":"2024-08-04T02:51:07Z","updated_at":"2026-11-03T03:24:19.692229Z"}],"ghsa":[{"id":"GHSA-cpx3-696p-3cw9","title":"OpenStack Neutron Denial of Service vulnerability","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2022-05-24T19:13:19Z","modified":"2024-09-25T17:55:08Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2021-40797","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T20:15:11.06Z","modified":"2026-06-17T04:07:27.94Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"CVE-2021-40797","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T20:15:11.06Z","modified":"2026-10-24T10:30:41.650179549Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-40797","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T20:15:11.06Z","modified":"2026-10-23T18:03:33.963049503Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-cpx3-696p-3cw9","title":"OpenStack Neutron Denial of Service vulnerability","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2022-05-24T19:13:19Z","modified":"2024-09-25T18:02:41.890251Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-772"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"RHSA-2022:0990","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (openstack-neutron) security update","status":"published","published":"2024-09-16T07:06:40Z","modified":"2026-10-08T10:02:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0996","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-neutron) security update","status":"published","published":"2024-09-16T07:06:33Z","modified":"2026-10-08T10:02:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2021-40797","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T20:15:00Z","modified":"2026-02-04T02:13:22.194828Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"PYSEC-2021-329","description":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","status":"published","published":"2021-09-08T20:15:00Z","modified":"2026-06-10T17:02:23.751801879Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-SU-2022:1884-1","title":"Security update for openstack-neutron","description":"This update for openstack-neutron fixes the following issues:\n\n- CVE-2021-40797: Fixed routes middleware memory leak for nonexistent controllers (bsc#1190339).\n- CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).\n","status":"published","published":"2022-05-31T06:55:12Z","modified":"2026-02-04T04:19:39.679624Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-6067-1","title":"neutron vulnerabilities","description":"David Sinquin discovered that OpenStack Neutron incorrectly handled the\ndefault Open vSwitch firewall rules. An attacker could possibly use this\nissue to impersonate the IPv6 addresses of other systems on the network.\nThis issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-20267)\n\nJake Yip and Justin Mammarella discovered that OpenStack Neutron\nincorrectly handled the linuxbridge driver when ebtables-nft is being\nused. An attacker could possibly use this issue to impersonate the hardware\naddresss of other systems on the network. This issue only affected Ubuntu\n18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-38598)\n\nPavel Toporkov discovered that OpenStack Neutron incorrectly handled\nextra_dhcp_opts values. An attacker could possibly use this issue to\nreconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and Ubuntu\n20.04 LTS. (CVE-2021-40085)\n\nSlawek Kaplonski discovered that OpenStack Neutron incorrectly handled the\nroutes middleware. An attacker could possibly use this issue to cause the\nAPI worker to consume memory, leading to a denial of service. This issue\nonly affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)\n\nIt was discovered that OpenStack Neutron incorrectly handled certain\nqueries. A remote authenticated user could possibly use this issue to cause\nresource consumption, leading to a denial of service. (CVE-2022-3277)\n","status":"published","published":"2023-05-10T11:30:08Z","modified":"2026-04-27T16:40:25.276108Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}