---
id: CVE-2015-5162
aliases:
  - GHSA-g2j5-7vgx-6xrx
  - PYSEC-2026-871
title: 'OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption'
summary: 'OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption'
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: cinder
product: cinder
ecosystem: pip
affected:
  - cinder < 7.0.2
  - 'cinder >= 8.0.0, < 9.0.0'
  - glance < 14.0.0
  - nova < 12.0.4
patched:
  - cinder 7.0.2
  - cinder 9.0.0
  - glance 14.0.0
  - nova 12.0.4
published: '2022-05-14'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g2j5-7vgx-6xrx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2015-5162'
  - url: >-
      https://github.com/openstack/cinder/commit/455b318ced717fb38dfe40014817d78fbc47dea5
  - url: >-
      https://github.com/openstack/glance/commit/69a9b659fd48aa3c1f84fc7bc9ae236b6803d31f
  - url: >-
      https://github.com/openstack/nova/commit/6bc37dcceca823998068167b49aec6def3112397
  - url: 'https://access.redhat.com/security/cve/CVE-2015-5162'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1268303'
  - url: 'https://launchpad.net/bugs/1449062'
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2923.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2016-2991.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2017-0153.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2017-0156.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2017-0165.html'
  - url: 'http://rhn.redhat.com/errata/RHSA-2017-0282.html'
  - url: 'http://www.openwall.com/lists/oss-security/2016/10/06/8'
  - url: 'http://www.securityfocus.com/bid/76849'
tags:
  - osv
  - pip
epss: 0.02945
epssPercentile: 0.86486
ingestedAt: '2026-07-08T18:25:49.180Z'
---

## Overview

The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4

## Affected packages

- `cinder < 7.0.2`
- `cinder >= 8.0.0, < 9.0.0`
- `glance < 14.0.0`
- `nova < 12.0.4`

## Remediation

Upgrade to a patched release:

- `cinder 7.0.2`
- `cinder 9.0.0`
- `glance 14.0.0`
- `nova 12.0.4`