OpenStack Ironic version 39.0.1 and earlier contain a flaw that allows a denial of service when a node requests a configdrive. The configdrive may contain an extremely large amount of uncompressed data, effectively a gzip bomb, which consumes excessive resources during processing. This can cause the Ironic service to become unresponsive and halt operations for that node.

The affected product is OpenStack Ironic, versions up to and including 39.0.1. Administrators should verify the installed release and determine if it falls within this range.

The CVSS score of 4.3 indicates a low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation via a configdrive request, which generally requires privileged access to the OpenStack environment or control over a node. Because the issue relies on a large payload, the attacker would need the ability to present this payload to the Ironic service.