---
id: CVE-2017-17051
aliases:
  - GHSA-vq76-rxx3-4r4r
  - PYSEC-2026-692
title: >-
  OpenStack Nova DoS by rebuilding the same instance with a new image multiple
  times
summary: >-
  OpenStack Nova DoS by rebuilding the same instance with a new image multiple
  times
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'
vendor: nova
product: nova
ecosystem: pip
affected:
  - nova < 16.0.4
patched:
  - nova 16.0.4
published: '2022-05-13'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vq76-rxx3-4r4r'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-17051'
  - url: >-
      https://github.com/openstack/nova/commit/25a1d78e83065c5bea5d8e0a017fd9d0914d41d9
  - url: >-
      https://github.com/openstack/nova/commit/fed660c1189fdf4159d97badfdc8c5b35ad14f23
  - url: 'https://github.com/openstack/nova'
  - url: 'https://launchpad.net/bugs/1732976'
  - url: 'https://review.openstack.org/521662'
  - url: 'https://review.openstack.org/523214'
  - url: 'https://security.openstack.org/ossa/OSSA-2017-006.html'
  - url: 'http://www.securityfocus.com/bid/102102'
tags:
  - osv
  - pip
epss: 0.01989
epssPercentile: 0.79761
ingestedAt: '2026-07-08T18:25:53.359Z'
---

## Overview

An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.

## Affected packages

- `nova < 16.0.4`

## Remediation

Upgrade to a patched release:

- `nova 16.0.4`