As per upstream announce at: https://wiki.openstack.org/wiki/OSSN/OSSN-0101 Summary The Nova console WebSocket proxy mutates a shared, process-global oslo.config allowed_origins list on every incoming request by appending the client-controlled Host header value. Because oslo.config returns a cached list object, these appends persist for the lifetime of the proxy process. This permanently weakens the cross-origin protection on the console proxy and causes unbounded memory growth. Affected Services / Software nova >=12.0.0 <31.3.2, >=32.0.0 <32.2.2, >=33.0.0 <33.0.3 Discussion On each request, the proxy appends the Host header to CONF.console.allowed_origins to allow the proxy's own hostname. This mutates the shared oslo.config cached list rather than operating on a copy, so any Host value ever seen is retained permanently for the life of the process. An unauthenticated attacker can inject arbitrary hostnames into the allow-list by sending requests with crafted Host headers, defeating the Origin check for all subsequent requests. The unbounded list growth also enables a slow memory exhaustion DoS. Recommended Actions Apply the provided Nova patches. The fix copies the config list before appending, so mutations do not persist across requests. Patches The following reviews contain the fix for this issue: 2026.2/hibiscus (development): https://review.opendev.org/c/openstack/nova/+/995870 2026.1/gazpacho: https://review.opendev.org/c/openstack/nova/+/995956 2025.2/flamingo: https://review.opendev.org/c/openstack/nova/+/995957 2025.1/epoxy: https://review.opendev.org/c/openstack/nova/+/995958 Credits Sergey r0binak Kanibor, Luntry Contacts / References Authors: Goutham Pacha Ravi, Red Hat This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0101 Original Launchpad bug: https://bugs.launchpad.net/nova/+bug/2158919 Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org OpenStack Security : https://security.openstack.org/ CVE: none
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/0b29e9c250f120c82a6a333f7547639c7579f875 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/186e54903749ee898ae0296c4080afe76863d832 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/0ccc94635fa6b70c3e4385b08f71c52ad061134e ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/3eec94e10f086100c9e666a1469c637749d45f00 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/d0fc5f002f83a11f1b49e1d38b5b8c8cfa08cf4f ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/40d0c298569c24019c6e78e613ad99b116f44a5e ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/37eaadd04c17bb44c0345ac517cc3f8c31485339 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/f0ac05a40ec087dda89be44cae859c0faf4f4542 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/629a9dcda462d433e25c9e97b448f499aca16242 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
We believe that the bug you reported is fixed in the latest version of
nova, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142113@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated nova package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 15 Jul 2026 14:38:22 +0200
Source: nova
Architecture: source
Version: 2:33.0.1-5
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1142113
Changes:
nova (2:33.0.1-5) unstable; urgency=high
.
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
Applied upstream patch: "Fix mutating global config in websocket proxy"
(Closes: #1142113).
Checksums-Sha1:
356230b61671fa5e2c2f4924c08ad5c9f28bf449 4706 nova_33.0.1-5.dsc
24299cf3e9bb2dddba64bf7eae324ec188deacec 72672 nova_33.0.1-5.debian.tar.xz
c8cdc35b669131c0e996b1a58c7a62536378bc29 25757 nova_33.0.1-5_amd64.buildinfo
Checksums-Sha256:
5398cf7ece3524c75d1d4954759acd83898254ff773685e44385a158a2ecae76 4706 nova_33.0.1-5.dsc
7e6722fc24d79cacb30a39fff8ead5b8e145cce05a4e3911790ef8e99f49a836 72672 nova_33.0.1-5.debian.tar.xz
c0bbd339a60aec7f19b6321ec95665c5061171570dd10f0b3bfee11f61f7bf2b 25757 nova_33.0.1-5_amd64.buildinfo
Files:
5e3cf9de8ed2a96ed032a07556bd415b 4706 net optional nova_33.0.1-5.dsc
4e5ff29e97694d8f816be8bdcd09930d 72672 net optional nova_33.0.1-5.debian.tar.xz
ef68e2f80d3bf4e1341b7c440abc5d4e 25757 net optional nova_33.0.1-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmpXv7cACgkQ1BatFaxr
Q/7axRAAgWY9NrYy1mJliVhF6mNlK0J5CDgz2w2UWdJF+KYotkGOiDrcvsWBVXWQ
Eb3SL5ORdZ7pypCXETjjVH7lee70S6upJRebx+5OVFxBLoO3YcjyQJmKI3s1UfmK
4LddGAa9iguoC0HSX3eU1rBT//XKVNL5sD3LEzDeplV1bC7Et2LtKvtJ8n2TL2Tk
2apuqF+9vKBzr8sCUsj6K88rLXvqjhq6nhDVCZT67Mx0ljJPEl7lnGABGVfKkyYX
YTsQv11lzpCmRgnmsbiwtRxj2jz8pEqAtZDmme3FumaJaQYTU2vqFZKI6oG3uAec
pucQXBCGb4POmi3xuit2UBVLDdnL55+fkB7d1Qngomlu/qKNl9wUu2Zpg6p6h8gg
sOntAcxMOjtDDiew6CD+gKCviFGKZXGnvjGHJcdwf7h4TI1FTCFkM+9jcanAMFwk
7EAZQvo9VRm0s/YNOcALA/nuvW/kAT/slPCJuECIn6KbcP7qMoy7UK2sGq5W8And
heiXYfcHpMi/VivjixVnrmDHiIMNJZnpBL3sLEol+qPaXjHK3InQbf2MOQXMP7Ic
zwF6TpG/cEHja3+DUoliGPfN5nP3Q404eQaOncAtOaO7CxqJBddiqJHiWt14PpTp
O487Y6I6vegtjgzgmO2nWJhmTReKRvIx7VoDJEzlnuKh+VQ400o=
=+ElW
-----END PGP SIGNATURE-----
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/e13c0919c578c94e1e52239e30262c36e4ff2923 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113
Hello, Bug #1142113 in nova reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/nova/-/commit/c190dd3ea643f8ce4caf216b7433720b9d0d7a15 ------------------------------------------------------------------------ * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning. Applied upstream patch: "Fix mutating global config in websocket proxy" (Closes: #1142113). ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142113