CVE-2023-3637: Red Hat OpenStack Platform 16.2 · Uncontrolled Resource Consumption
Affects Red Hat OpenStack Platform 16.2Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 1.3% chance of exploitation in 30 days – higher than 70% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 25 Jul 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2023-3637, organizations should implement the following specific measures: 1) Enforce strict user quota policies and validate that quota limits apply correctly to all resource requests, including those for invalid projects. 2) Monitor Neutron API logs for unusual patterns such as repeated queries for invalid projects or excessive security group requests from authenticated users. 3) Restrict access to the Neutron API to only trusted and necessary users, employing role-based access controls (RBAC) to minimize the number of users with permissions to query security groups. 4) Implement anomaly detection systems to alert on potential abuse of resource consumption. 5) Regularly audit user accounts and credentials to reduce the risk of compromised accounts being used for exploitation. 6) Stay updated with Red Hat advisories and apply patches or updates as soon as they become available. 7) Consider network-level protections such as rate limiting or API gateway controls to throttle excessive requests. These steps go beyond generic advice by focusing on quota enforcement validation, monitoring specific API usage patterns, and access restriction tailored to the vulnerability's exploitation vector.
Description
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.