{"id":"CVE-2022-3277","aliases":["DEBIAN-CVE-2022-3277","EUVD-2023-1125","GHSA-w446-h7vg-wv3p","PYSEC-2026-855","RHSA-2022:8855","RHSA-2022:8870","RHSA-2023:0275","UBUNTU-CVE-2022-3277","USN-6067-1"],"status":"published","title":"openstack-neutron uncontrolled resource consumption flaw","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01065,"percentile":0.64934,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-03-06T00:00:00Z","modified":"2026-11-03T06:02:37Z","fixes":[{"ecosystem":"PyPI","package":"neutron","fixed_in":["19.5.0","18.6.0","20.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"neutron","fixed_in":["2:21.0.0~rc1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"neutron","fixed_in":["2:21.0.0~rc1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"neutron","fixed_in":["2:21.0.0~rc1-3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-common","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-linuxbridge","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-macvtap-agent","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-metering-agent","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-ml2","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-openvswitch","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-rpc-server","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-sriov-nic-agent","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-neutron","fixed_in":["1:15.3.5-2.20221005184727.c81fb5b.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-common","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-linuxbridge","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-macvtap-agent","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-metering-agent","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-ml2","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-openvswitch","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-rpc-server","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-sriov-nic-agent","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-neutron","fixed_in":["1:15.2.1-1.20221005123225.40d217c.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-neutron","fixed_in":["1:18.4.1-0.20221128170741.5258354.el9ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"neutron","fixed_in":["2:12.1.1-0ubuntu8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"neutron","fixed_in":["2:16.4.2-0ubuntu6.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"neutron","fixed_in":["2:20.3.0-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0.0rc1"},{"fixed":"19.5.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0.0rc1"},{"fixed":"20.3.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.0~rc1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.0~rc1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.0.0~rc1-3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"19.0.0.0rc1"},{"fixed":"19.5.0"}]}],"versions":["19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.1.0","19.2.0","19.3.0","19.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0"}]}],"versions":["0.0","10.0.5","10.0.6","10.0.7","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","12.0.0","12.0.0.0b3","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.1.0","12.1.1","13.0.0","13.0.0.0b1","13.0.0.0b2","13.0.0.0b3","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.0.3","13.0.4","13.0.5","13.0.6","13.0.7","14.0.0","14.0.0.0b1","14.0.0.0b2","14.0.0.0b3","14.0.0.0rc1","14.0.1","14.0.2","14.0.3","14.0.4","14.1.0","14.2.0","14.3.0","14.3.1","14.4.0","14.4.1","14.4.2","15.0.0","15.0.0.0b1","15.0.0.0rc1","15.0.0.0rc2","15.0.1","15.0.2","15.1.0","15.2.0","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","16.0.0","16.0.0.0b1","16.0.0.0rc1","16.0.0.0rc2","16.1.0","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.4.2","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.1.0","17.1.1","17.1.2","17.2.0","17.2.1","17.3.0","17.4.0","17.4.1","18.0.0","18.0.0.0rc1","18.0.0.0rc2","18.1.0","18.1.1","18.2.0","18.3.0","18.4.0","18.5.0"]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.0.0.0rc1"},{"fixed":"20.3.0"}]}],"versions":["20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.1.0","20.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0"},{"introduced":"19.0.0.0rc1"},{"fixed":"19.5.0"},{"introduced":"20.0.0.0rc1"},{"fixed":"20.3.0"}]}],"versions":["0.0","10.0.5","10.0.6","10.0.7","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","12.0.0","12.0.0.0b3","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.1.0","12.1.1","13.0.0","13.0.0.0b1","13.0.0.0b2","13.0.0.0b3","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.0.3","13.0.4","13.0.5","13.0.6","13.0.7","14.0.0","14.0.0.0b1","14.0.0.0b2","14.0.0.0b3","14.0.0.0rc1","14.0.1","14.0.2","14.0.3","14.0.4","14.1.0","14.2.0","14.3.0","14.3.1","14.4.0","14.4.1","14.4.2","15.0.0","15.0.0.0b1","15.0.0.0rc1","15.0.0.0rc2","15.0.1","15.0.2","15.1.0","15.2.0","15.3.0","15.3.1","15.3.2","15.3.3","15.3.4","16.0.0","16.0.0.0b1","16.0.0.0rc1","16.0.0.0rc2","16.1.0","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.4.2","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.1.0","17.1.1","17.1.2","17.2.0","17.2.1","17.3.0","17.4.0","17.4.1","18.0.0","18.0.0.0rc1","18.0.0.0rc2","18.1.0","18.1.1","18.2.0","18.3.0","18.4.0","18.5.0","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.1.0","19.2.0","19.3.0","19.4.0","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.1.0","20.2.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-linuxbridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-macvtap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-metering-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-ml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-rpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-neutron-sriov-nic-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.3.5-2.20221005184727.c81fb5b.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-linuxbridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-macvtap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-metering-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-ml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-rpc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-neutron-sriov-nic-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.2.1-1.20221005123225.40d217c.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.4.1-0.20221128170741.5258354.el9ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.0.0-0ubuntu1","2:8.0.0~b1-0ubuntu2","2:8.0.0~b2-0ubuntu4","2:8.0.0~b2-0ubuntu5","2:8.0.0~b2-0ubuntu7","2:8.0.0~b3-0ubuntu1","2:8.0.0~rc1-0ubuntu1","2:8.0.0-0ubuntu1","2:8.1.0-0ubuntu0.16.04.2","2:8.1.2-0ubuntu1","2:8.2.0-0ubuntu1","2:8.3.0-0ubuntu1","2:8.3.0-0ubuntu1.1","2:8.3.0-0ubuntu1.2","2:8.4.0-0ubuntu1","2:8.4.0-0ubuntu2","2:8.4.0-0ubuntu3","2:8.4.0-0ubuntu4","2:8.4.0-0ubuntu5","2:8.4.0-0ubuntu6","2:8.4.0-0ubuntu7.1","2:8.4.0-0ubuntu7.2","2:8.4.0-0ubuntu7.3","2:8.4.0-0ubuntu7.4","2:8.4.0-0ubuntu7.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.1.1-0ubuntu8.1"}]}],"versions":["2:11.0.1-0ubuntu1","2:12.0.0~b1-0ubuntu1","2:12.0.0~b1-0ubuntu2","2:12.0.0~b2-0ubuntu1","2:12.0.0~b3-0ubuntu1","2:12.0.0~rc1-0ubuntu1","2:12.0.0~rc2-0ubuntu1","2:12.0.0-0ubuntu1","2:12.0.0-0ubuntu1.1","2:12.0.0-0ubuntu1.2","2:12.0.0-0ubuntu1.3","2:12.0.0-0ubuntu1.4","2:12.0.0-0ubuntu2","2:12.0.0-0ubuntu3","2:12.0.1-0ubuntu1","2:12.0.1-0ubuntu1.1","2:12.0.2-0ubuntu1","2:12.0.3-0ubuntu1","2:12.0.5-0ubuntu1","2:12.0.5-0ubuntu4","2:12.0.5-0ubuntu5","2:12.0.6-0ubuntu1","2:12.0.6-0ubuntu2","2:12.0.6-0ubuntu3","2:12.1.0-0ubuntu1","2:12.1.1-0ubuntu1","2:12.1.1-0ubuntu2","2:12.1.1-0ubuntu3","2:12.1.1-0ubuntu4","2:12.1.1-0ubuntu7","2:12.1.1-0ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.4.2-0ubuntu6.2"}]}],"versions":["2:15.0.0-0ubuntu1","2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4","2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2","2:16.0.0-0ubuntu0.20.04.1","2:16.0.0-0ubuntu0.20.04.2","2:16.1.0-0ubuntu1","2:16.1.0-0ubuntu2","2:16.2.0-0ubuntu1","2:16.2.0-0ubuntu2","2:16.2.0-0ubuntu3","2:16.3.0-0ubuntu3","2:16.3.1-0ubuntu1","2:16.3.1-0ubuntu1.1","2:16.3.2-0ubuntu2","2:16.3.2-0ubuntu3","2:16.4.0-0ubuntu2","2:16.4.0-0ubuntu3","2:16.4.1-0ubuntu2","2:16.4.2-0ubuntu1","2:16.4.2-0ubuntu2","2:16.4.2-0ubuntu3","2:16.4.2-0ubuntu4","2:16.4.2-0ubuntu5","2:16.4.2-0ubuntu6","2:16.4.2-0ubuntu6.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:20.3.0-0ubuntu1.1"}]}],"versions":["2:19.0.0-0ubuntu1","2:19.1.0+git2022030313.b072cbf05f-0ubuntu1","2:20.0.0-0ubuntu1","2:20.0.0-0ubuntu2","2:20.0.0-0ubuntu3","2:20.1.0-0ubuntu2","2:20.2.0-0ubuntu1","2:20.3.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:12.1.1-0ubuntu8.1"}]}],"versions":["2:11.0.1-0ubuntu1","2:12.0.0~b1-0ubuntu1","2:12.0.0~b1-0ubuntu2","2:12.0.0~b2-0ubuntu1","2:12.0.0~b3-0ubuntu1","2:12.0.0~rc1-0ubuntu1","2:12.0.0~rc2-0ubuntu1","2:12.0.0-0ubuntu1","2:12.0.0-0ubuntu1.1","2:12.0.0-0ubuntu1.2","2:12.0.0-0ubuntu1.3","2:12.0.0-0ubuntu1.4","2:12.0.0-0ubuntu2","2:12.0.0-0ubuntu3","2:12.0.1-0ubuntu1","2:12.0.1-0ubuntu1.1","2:12.0.2-0ubuntu1","2:12.0.3-0ubuntu1","2:12.0.5-0ubuntu1","2:12.0.5-0ubuntu4","2:12.0.5-0ubuntu5","2:12.0.6-0ubuntu1","2:12.0.6-0ubuntu2","2:12.0.6-0ubuntu3","2:12.1.0-0ubuntu1","2:12.1.1-0ubuntu1","2:12.1.1-0ubuntu2","2:12.1.1-0ubuntu3","2:12.1.1-0ubuntu4","2:12.1.1-0ubuntu7","2:12.1.1-0ubuntu8"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:16.4.2-0ubuntu6.2"}]}],"versions":["2:15.0.0-0ubuntu1","2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1","2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3","2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4","2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1","2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2","2:16.0.0-0ubuntu0.20.04.1","2:16.0.0-0ubuntu0.20.04.2","2:16.1.0-0ubuntu1","2:16.1.0-0ubuntu2","2:16.2.0-0ubuntu1","2:16.2.0-0ubuntu2","2:16.2.0-0ubuntu3","2:16.3.0-0ubuntu3","2:16.3.1-0ubuntu1","2:16.3.1-0ubuntu1.1","2:16.3.2-0ubuntu2","2:16.3.2-0ubuntu3","2:16.4.0-0ubuntu2","2:16.4.0-0ubuntu3","2:16.4.1-0ubuntu2","2:16.4.2-0ubuntu1","2:16.4.2-0ubuntu2","2:16.4.2-0ubuntu3","2:16.4.2-0ubuntu4","2:16.4.2-0ubuntu5","2:16.4.2-0ubuntu6","2:16.4.2-0ubuntu6.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:20.3.0-0ubuntu1.1"}]}],"versions":["2:19.0.0-0ubuntu1","2:19.1.0+git2022030313.b072cbf05f-0ubuntu1","2:20.0.0-0ubuntu1","2:20.0.0-0ubuntu2","2:20.0.0-0ubuntu3","2:20.1.0-0ubuntu2","2:20.2.0-0ubuntu1","2:20.3.0-0ubuntu1"],"bundled":5}],"products":[{"vendor":"openstack","product":"neutron"},{"vendor":"redhat","product":"openstack_platform"},{"vendor":"the openstack project","product":"openstack-neutron"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129193","tags":["x_transferred","exploit","Issue Tracking","Patch","Vendor Advisory","report","web"]},{"url":"https://bugs.launchpad.net/neutron/+bug/1988026","tags":["x_transferred","exploit","Issue Tracking","Patch","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3277","tags":["advisory"]},{"url":"https://github.com/openstack/neutron/commit/01fc2b9195f999df4d810df4ee63f77ecbc81f7e","tags":["web"]},{"url":"https://github.com/openstack/neutron/commit/717e3e09556f1fb9a7a420863746fa785eb6c316","tags":["web"]},{"url":"https://github.com/openstack/neutron/commit/733ef4f2d8c2a3734c360d1c1dd3a6fcd600cb8c","tags":["web"]},{"url":"https://github.com/openstack/neutron/commit/cbeee87fa44cd200d4997e02042098460167dce1","tags":["web"]},{"url":"https://github.com/openstack/neutron/commit/d0e1b54fb1de932b2b30ab4269cf5789632df476","tags":["web"]},{"url":"https://github.com/openstack/neutron/commit/fd7fb0e9d8c602380f54975367d935ab69e10c05","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w446-h7vg-wv3p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3277.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3277","tags":["advisory"]},{"url":"https://github.com/openstack/neutron","tags":["package"]},{"url":"https://pypi.org/project/neutron","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8855","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135922","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8855.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3277","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8870","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2078266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129712","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8870.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0275","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2132152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2132228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2132405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2144564","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0275.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3277","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6067-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-20267","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-38598","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40797","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-3277","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-06T00:00:00Z","modified":"2025-03-07T15:54:48.807Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2023-1125","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-06T00:00:00Z","modified":"2025-03-07T15:54:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-w446-h7vg-wv3p","title":"openstack-neutron uncontrolled resource consumption flaw","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-07T00:30:25Z","modified":"2024-05-14T21:22:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2022-3277","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-06T23:15:10.763Z","modified":"2026-06-17T04:59:12.607Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:36.601381Z"}],"osv":[{"id":"CVE-2022-3277","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-06T00:00:00Z","modified":"2026-10-28T02:31:15.043458354Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"GHSA-w446-h7vg-wv3p","title":"openstack-neutron uncontrolled resource consumption flaw","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-07T00:30:25Z","modified":"2026-07-07T11:56:12.853825242Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"PYSEC-2026-855","title":"openstack-neutron uncontrolled resource consumption flaw","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2026-07-07T10:17:28.235305Z","modified":"2026-07-07T11:45:19.090896912Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2022:8855","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (openstack-neutron) security update","status":"published","published":"2024-09-16T09:28:54Z","modified":"2026-08-04T10:05:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8870","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-neutron) security update","status":"published","published":"2024-09-16T09:29:01Z","modified":"2026-08-04T10:05:46Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0275","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (openstack-neutron) security update","status":"published","published":"2024-09-16T09:29:09Z","modified":"2026-08-04T10:05:54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-3277","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-06T23:15:00Z","modified":"2026-02-04T04:32:51.293036Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"DEBIAN-CVE-2022-3277","description":"An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.","status":"published","published":"2023-03-06T23:15:10.763Z","modified":"2026-11-03T06:02:37.589314186Z","updated_at":"2026-11-03T06:43:43.638289Z"},{"id":"USN-6067-1","title":"neutron vulnerabilities","description":"David Sinquin discovered that OpenStack Neutron incorrectly handled the\ndefault Open vSwitch firewall rules. An attacker could possibly use this\nissue to impersonate the IPv6 addresses of other systems on the network.\nThis issue only affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.\n(CVE-2021-20267)\n\nJake Yip and Justin Mammarella discovered that OpenStack Neutron\nincorrectly handled the linuxbridge driver when ebtables-nft is being\nused. An attacker could possibly use this issue to impersonate the hardware\naddresss of other systems on the network. This issue only affected Ubuntu\n18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-38598)\n\nPavel Toporkov discovered that OpenStack Neutron incorrectly handled\nextra_dhcp_opts values. An attacker could possibly use this issue to\nreconfigure dnsmasq. This issue only affected Ubuntu 18.04 LTS, and Ubuntu\n20.04 LTS. (CVE-2021-40085)\n\nSlawek Kaplonski discovered that OpenStack Neutron incorrectly handled the\nroutes middleware. An attacker could possibly use this issue to cause the\nAPI worker to consume memory, leading to a denial of service. This issue\nonly affected Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-40797)\n\nIt was discovered that OpenStack Neutron incorrectly handled certain\nqueries. A remote authenticated user could possibly use this issue to cause\nresource consumption, leading to a denial of service. (CVE-2022-3277)\n","status":"published","published":"2023-05-10T11:30:08Z","modified":"2026-04-27T16:40:25.276108Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}