---
id: CVE-2015-5286
aliases:
  - GHSA-gvjg-r9fv-7qx9
  - PYSEC-2026-812
title: >-
  OpenStack Image Service (Glance) allows remote authenticated users to bypass
  storage quota, cause denial of service
summary: >-
  OpenStack Image Service (Glance) allows remote authenticated users to bypass
  storage quota, cause denial of service
severity: medium
vendor: glance
product: glance
ecosystem: pip
affected:
  - glance < 2014.2.4
  - 'glance >= 2015.1.0, < 2015.1.2'
patched:
  - glance 2014.2.4
  - glance 2015.1.2
published: '2022-05-17'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:22.977954211Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gvjg-r9fv-7qx9'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2015-5286'
  - url: 'https://access.redhat.com/errata/RHSA-2015:1897'
  - url: 'https://access.redhat.com/security/cve/CVE-2015-5286'
  - url: 'https://bugs.launchpad.net/bugs/1498163'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1267516'
  - url: 'https://opendev.org/openstack/glance'
  - url: 'https://rhn.redhat.com/errata/RHSA-2015-1897.html'
  - url: 'https://security.openstack.org/ossa/OSSA-2015-020.html'
  - url: >-
      https://web.archive.org/web/20200228024859/http://www.securityfocus.com/bid/76943
tags:
  - osv
  - pip
epss: 0.02396
epssPercentile: 0.83121
ingestedAt: '2026-07-08T18:25:49.937Z'
---

## Overview

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.

## Affected packages

- `glance < 2014.2.4`
- `glance >= 2015.1.0, < 2015.1.2`

## Remediation

Upgrade to a patched release:

- `glance 2014.2.4`
- `glance 2015.1.2`