Cyber ·
OSSA-2026-049: DoS in Ironic Conductor
A security advisory reports denial of service in Ironic Conductor caused by a configdrive containing a gzip bomb. The issue is identified as CVE-2026-115638.
The OSSA-2026-049 advisory, published on October 29, 2026, describes denial of service in Ironic Conductor caused by a configdrive containing a gzip bomb. The issue is identified as CVE-2026-115638. The report is attributed to Jay Faulkner of G-Research Open Source Software.
The advisory lists affected Ironic versions, but the available formatting does not make the version boundaries clear enough to determine them reliably. Consult the original advisory by its OSSA-2026-049 or CVE-2026-115638 identifier and verify the affected versions and remediation guidance there before taking action.
Original source: OSSA-2026-049: DoS no Ironic Conductor por configdrive com bomba gzip