The vulnerability originates from an infinite loop in OpenStack Ironic's checksum calculations during image handling. When an image is referenced with a file:///dev/zero URL, the checksum routine never terminates, consuming CPU cycles. This can lead to resource exhaustion and service disruption for the Ironic controller, potentially impacting the availability of the OpenStack deployment. The weakness is identified as CWE-696, which signifies an error in control flow leading to malfunction or denial of service.

OpenStack Ironic versions prior to the commit a3f6d73 (any 35.x release) are affected. Users running 35.x branches without the patch are vulnerable.

The CVSS score of 4.3 indicates a moderate severity and potential availability impact. EPSS data is not available, and the vulnerability is not listed in the KEV catalog, suggesting limited known exploitation. The attack requires supply of a file URI to the image handling endpoint, so it is most likely exploitable by users who can submit or influence image metadata. In the worst case, this could lead to a denial of service for the Ironic service. The lack of public exploitation reduces immediate risk, but the availability impact remains a concern.