openstack-network-exporter: missing HTTP header timeouts let an unauthenticated attacker exhaust file descriptors

Impact

The exporter's HTTP server is configured without ReadHeaderTimeout or the other basic timeouts, so an unauthenticated attacker can open many connections and trickle header bytes until file descriptors run out - a slowloris. The exporter then stops answering Prometheus scrapes, which means the network metrics and the alerts built on them go silent for that host while everything else keeps running. That is a monitoring blind spot rather than a compromise: nothing is disclosed or modified, and the vendor rates availability impact low. It is worth closing because the exporter normally listens on a management or metrics network where anyone with a foothold can reach it unauthenticated, and silent monitoring is how a real fault goes unnoticed.

Who can reach it

Anyone who can open TCP connections to the exporter's metrics port - in practice anyone on the management or metrics network, or a workload that can route to it. No authentication required.

What to do

Apply the Red Hat OpenStack Platform 18.0 update for openstack-network-exporter when it ships and restart the exporter; the record does not name a fixed version yet. In the meantime, bind the exporter to the metrics network only and restrict its port to the Prometheus scrapers with a host firewall rule, or front it with a proxy that enforces header timeouts. Either way this is a service restart, not node work.

References

Related entries

• GitLab CE/EE: incorrect authorization lets an unauthenticated user read work items in private groups and projectsCVE-2026-84284 · GitLab CE/EE (work item authorization)Medium
• Ansible automation-controller: Bitbucket DC webhook ping skips HMAC check, enumerating webhook-enabled templatesCVE-2026-84717 · Red Hat Ansible Automation Platform automation-controller (Bitbucket Data Center webhook receiver)Medium
• GitLab CE/EE: GraphQL authorization flaw exposes internal and confidential system notes on public projectsCVE-2026-85529 · GitLab CE/EE (GraphQL API, internal and confidential system notes)Medium
• Checkmk REST API: host configuration GET responses return SNMP and IPMI credentials in clear textCVE-2026-92882 · Checkmk REST API (host and folder configuration endpoints)Medium
• DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls): Stack corruption inside the firmwareNCVD-2026-006-dmtf-libspdm-csr-generation-unde · DMTF libspdm CSR generation under the mbedTLS crypto backend (cryptlib_mbedtls)Medium
• DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOG: A requester reads memory it was never authorisedNCVD-2026-007-dmtf-libspdm-responder-handling · DMTF libspdm responder handling of GET_MEASUREMENT_EXTENSION_LOGMedium