CVE-2026-43002

MediumCVSS 5.3

Published: 05/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

In OpenStack Horizon versions 25.6 and 25.7 before 25.7.3, a write operation to the session storage backend occurs before authentication, allowing unauthenticated requests to exhaust storage. This is a regression of the CVE-2014-8124 fix.

Risk Assessment

Unauthenticated attackers can exhaust session storage backend disk space, causing denial of service (DoS) for all users.

Recommendation

Upgrade OpenStack Horizon to version 25.7.3 or later.

Original NVD description (English source)

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix.