CVE-2026-24708
CVE-2026-24708
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
CVSS 8.2 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
nova
- Versions
- ≥ 0, < 30.2.2: Affected (semver)
- ≥ 31.0.0, < 31.2.1: Affected (semver)
- ≥ 32.0.0, < 32.1.1: Affected (semver)
Update to 30.2.2; Update to 31.2.1; Update to 32.1.1
nova Debian:12
- Versions
- 2:26.1.0-4
- 2:26.2.2-1~deb12u3
- Affected ranges
- ECOSYSTEM: < 2:26.2.2-1~deb12u4
Update to 2:26.2.2-1~deb12u4
nova Debian:13
- Versions
- 2:31.0.0-6
- 2:31.0.0-6+deb13u1
- Affected ranges
- ECOSYSTEM: < 2:31.0.0-6+deb13u2
Update to 2:31.0.0-6+deb13u2
nova Debian:14
- Versions
- 2:31.0.0-6
- 2:31.0.0-7
- 2:32.0.0-1
- 2:32.0.0~rc1-1
- 2:32.0.0~rc1-2
- 2:32.0.0~rc1-3
- 2:32.1.0-1
- 2:32.1.0-2
- 2:32.1.0-3
- 2:32.1.0-4
- 2:32.1.0-5
- 2:32.1.0-6
- Affected ranges
- ECOSYSTEM: < 2:32.1.0-7
Update to 2:32.1.0-7
nova PyPI
- Versions
- 32.0.0
- 32.0.0.0rc1
- 32.1.0
- Affected ranges
- ECOSYSTEM: ≥ 32.0.0.0rc1, ≤ 32.1.0
No fix published
nova PyPI
- Versions
- 31.0.0
- 31.0.0.0rc1
- 31.0.1
- 31.1.0
- 31.2.0
- Affected ranges
- ECOSYSTEM: ≥ 31.0.0.0rc1, ≤ 31.2.0
No fix published
nova PyPI
- Versions
- 15.1.5
- 16.1.6
- 16.1.7
- 16.1.8
- 17.0.10
- 17.0.11
- 17.0.12
- 17.0.13
- 17.0.7
- 17.0.8
- 17.0.9
- 18.0.2
- 18.0.3
- 18.1.0
- 18.2.0
- 18.2.1
- 18.2.2
- 18.2.3
- 18.3.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.1.0
- 19.2.0
- 19.3.0
- 19.3.1
- 19.3.2
- 20.0.0
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.1.1
- 20.2.0
- 20.3.0
- 20.4.0
- 20.4.1
- 20.5.0
- 20.6.0
- 20.6.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 21.1.1
- 21.1.2
- 21.2.0
- 21.2.1
- 21.2.2
- 21.2.3
- 21.2.4
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.1.0
- 22.2.0
- 22.2.1
- 22.2.2
- 22.3.0
- 22.4.0
- 23.0.0
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.0.1
- 23.0.2
- 23.1.0
- 23.2.0
- 23.2.1
- 23.2.2
- 24.0.0
- 24.0.0.0rc1
- 24.0.0.0rc2
- 24.1.0
- 24.1.1
- 24.2.0
- 24.2.1
- 25.0.0
- 25.0.0.0rc1
- 25.0.1
- 25.1.0
- 25.1.1
- 25.2.0
- 25.2.1
- 25.3.0
- 26.0.0
- 26.0.0.0rc1
- 26.0.0.0rc2
- 26.1.0
- 26.1.1
- 26.2.0
- 26.2.1
- 26.2.2
- 26.3.0
- 27.0.0
- 27.0.0.0rc1
- 27.1.0
- 27.2.0
- 27.3.0
- 27.4.0
- 27.5.0
- 27.5.1
- 28.0.0
- 28.0.0.0rc1
- 28.0.1
- 28.1.0
- 28.2.0
- 28.3.0
- 28.3.1
- 29.0.0
- 29.0.0.0rc1
- 29.0.1
- 29.0.2
- 29.1.0
- 29.2.0
- 29.2.1
- 29.2.2
- 29.3.0
- 29.4.0
- 30.0.0
- 30.0.0.0rc1
- 30.1.0
- 30.2.0
- 30.2.1
- Affected ranges
- ECOSYSTEM: ≤ 30.2.1
No fix published
nova PyPI
- Versions
- 15.1.5
- 16.1.6
- 16.1.7
- 16.1.8
- 17.0.10
- 17.0.11
- 17.0.12
- 17.0.13
- 17.0.7
- 17.0.8
- 17.0.9
- 18.0.2
- 18.0.3
- 18.1.0
- 18.2.0
- 18.2.1
- 18.2.2
- 18.2.3
- 18.3.0
- 19.0.0
- 19.0.0.0rc1
- 19.0.0.0rc2
- 19.0.1
- 19.0.2
- 19.0.3
- 19.1.0
- 19.2.0
- 19.3.0
- 19.3.1
- 19.3.2
- 20.0.0
- 20.0.0.0rc1
- 20.0.0.0rc2
- 20.0.1
- 20.1.0
- 20.1.1
- 20.2.0
- 20.3.0
- 20.4.0
- 20.4.1
- 20.5.0
- 20.6.0
- 20.6.1
- 21.0.0
- 21.0.0.0rc1
- 21.0.0.0rc2
- 21.1.0
- 21.1.1
- 21.1.2
- 21.2.0
- 21.2.1
- 21.2.2
- 21.2.3
- 21.2.4
- 22.0.0
- 22.0.0.0rc1
- 22.0.1
- 22.1.0
- 22.2.0
- 22.2.1
- 22.2.2
- 22.3.0
- 22.4.0
- 23.0.0
- 23.0.0.0rc1
- 23.0.0.0rc2
- 23.0.1
- 23.0.2
- 23.1.0
- 23.2.0
- 23.2.1
- 23.2.2
- 24.0.0
- 24.0.0.0rc1
- 24.0.0.0rc2
- 24.1.0
- 24.1.1
- 24.2.0
- 24.2.1
- 25.0.0
- 25.0.0.0rc1
- 25.0.1
- 25.1.0
- 25.1.1
- 25.2.0
- 25.2.1
- 25.3.0
- 26.0.0
- 26.0.0.0rc1
- 26.0.0.0rc2
- 26.1.0
- 26.1.1
- 26.2.0
- 26.2.1
- 26.2.2
- 26.3.0
- 27.0.0
- 27.0.0.0rc1
- 27.1.0
- 27.2.0
- 27.3.0
- 27.4.0
- 27.5.0
- 27.5.1
- 28.0.0
- 28.0.0.0rc1
- 28.0.1
- 28.1.0
- 28.2.0
- 28.3.0
- 28.3.1
- 29.0.0
- 29.0.0.0rc1
- 29.0.1
- 29.0.2
- 29.1.0
- 29.2.0
- 29.2.1
- 29.2.2
- 29.3.0
- 29.4.0
- 30.0.0
- 30.0.0.0rc1
- 30.1.0
- 30.2.0
- 30.2.1
- 31.0.0
- 31.0.0.0rc1
- 31.0.1
- 31.1.0
- 31.2.0
- 32.0.0
- 32.0.0.0rc1
- 32.1.0
- Affected ranges
- ECOSYSTEM: ≤ 30.2.1 ∪ ≥ 31.0.0.0rc1, ≤ 31.2.0 ∪ ≥ 32.0.0.0rc1, ≤ 32.1.0
No fix published
nova Ubuntu:Pro:16.04:LTS
- Versions
- 2:12.0.0-0ubuntu2
- 2:13.0.0~b1-0ubuntu1
- 2:13.0.0~b2-0ubuntu1
- 2:13.0.0~b3-0ubuntu1
- 2:13.0.0~rc1-0ubuntu1
- 2:13.0.0~rc3-0ubuntu1
- 2:13.0.0-0ubuntu1
- 2:13.0.0-0ubuntu2
- 2:13.0.0-0ubuntu5
- 2:13.1.0-0ubuntu1
- 2:13.1.1-0ubuntu1
- 2:13.1.1-0ubuntu1.1
- 2:13.1.2-0ubuntu2
- 2:13.1.3-0ubuntu1
- 2:13.1.3-0ubuntu2
- 2:13.1.4-0ubuntu1
- 2:13.1.4-0ubuntu2
- 2:13.1.4-0ubuntu3
- 2:13.1.4-0ubuntu4.1
- 2:13.1.4-0ubuntu4.2
- 2:13.1.4-0ubuntu4.3
- 2:13.1.4-0ubuntu4.4
- 2:13.1.4-0ubuntu4.5
- 2:13.1.4-0ubuntu4.5+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nova Ubuntu:Pro:18.04:LTS
- Versions
- 2:16.0.1-0ubuntu1
- 2:16.0.1-0ubuntu2
- 2:17.0.0~b1-0ubuntu1
- 2:17.0.0~b2-0ubuntu2
- 2:17.0.0~b3-0ubuntu3
- 2:17.0.0~b3-0ubuntu4
- 2:17.0.0~rc1-0ubuntu1
- 2:17.0.0~rc2-0ubuntu1
- 2:17.0.0~rc3-0ubuntu1
- 2:17.0.0-0ubuntu1
- 2:17.0.1-0ubuntu1
- 2:17.0.3-0ubuntu1
- 2:17.0.4-0ubuntu1
- 2:17.0.5-0ubuntu1
- 2:17.0.5-0ubuntu2
- 2:17.0.6-0ubuntu1
- 2:17.0.7-0ubuntu1
- 2:17.0.7-0ubuntu2
- 2:17.0.9-0ubuntu1
- 2:17.0.9-0ubuntu3
- 2:17.0.10-0ubuntu2
- 2:17.0.10-0ubuntu2.1
- 2:17.0.11-0ubuntu1
- 2:17.0.12-0ubuntu1
- 2:17.0.13-0ubuntu1
- 2:17.0.13-0ubuntu2
- 2:17.0.13-0ubuntu3
- 2:17.0.13-0ubuntu4
- 2:17.0.13-0ubuntu5
- 2:17.0.13-0ubuntu5.2
- 2:17.0.13-0ubuntu5.3
- 2:17.0.13-0ubuntu5.4
- 2:17.0.13-0ubuntu5.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nova Ubuntu:Pro:20.04:LTS
- Versions
- 2:20.0.0-0ubuntu1
- 2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1
- 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu2
- 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu4
- 2:21.0.0~b2~git2020021008.1fcd74730d-0ubuntu5
- 2:21.0.0~b3~git2020041013.57ff308d6d-0ubuntu2
- 2:21.0.0-0ubuntu0.20.04.1
- 2:21.0.0-0ubuntu0.20.04.2
- 2:21.1.0-0ubuntu1
- 2:21.1.1-0ubuntu2
- 2:21.1.2-0ubuntu1
- 2:21.2.0-0ubuntu1
- 2:21.2.1-0ubuntu1
- 2:21.2.2-0ubuntu1
- 2:21.2.3-0ubuntu1
- 2:21.2.4-0ubuntu1
- 2:21.2.4-0ubuntu2
- 2:21.2.4-0ubuntu2.1
- 2:21.2.4-0ubuntu2.2
- 2:21.2.4-0ubuntu2.3
- 2:21.2.4-0ubuntu2.4
- 2:21.2.4-0ubuntu2.5
- 2:21.2.4-0ubuntu2.6
- 2:21.2.4-0ubuntu2.8
- 2:21.2.4-0ubuntu2.11
- 2:21.2.4-0ubuntu2.13
- 2:21.2.4-0ubuntu2.14
- 2:21.2.4-0ubuntu2.14+esm1
- 2:21.2.4-0ubuntu2.14+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nova Ubuntu:22.04:LTS
- Versions
- 3:24.0.0-0ubuntu1
- 3:24.0.0+git2022030310.3f274c65cc-0ubuntu2
- 3:25.0.0-0ubuntu1
- 3:25.0.0-0ubuntu1.1
- 3:25.0.1-0ubuntu1
- 3:25.1.0-0ubuntu1
- 3:25.1.0-0ubuntu2
- 3:25.1.0-0ubuntu2.1
- 3:25.1.0-0ubuntu2.2
- 3:25.1.1-0ubuntu1
- 3:25.1.1-0ubuntu1.1
- 3:25.2.0-0ubuntu1
- 3:25.2.1-0ubuntu1
- 3:25.2.1-0ubuntu2
- 3:25.2.1-0ubuntu2.3
- 3:25.2.1-0ubuntu2.6
- 3:25.2.1-0ubuntu2.7
- 3:25.2.1-0ubuntu2.8
- 3:25.2.1-0ubuntu2.9
- Affected ranges
- ECOSYSTEM: < 3:25.2.1-0ubuntu2.10
Update to 3:25.2.1-0ubuntu2.10
nova Ubuntu:24.04:LTS
- Versions
- 3:28.0.0-0ubuntu1
- 3:28.0.1+git2024011916.087c372a-0ubuntu1
- 3:28.0.1+git2024011916.087c372a-0ubuntu2
- 3:29.0.0~rc1-0ubuntu2
- 3:29.0.1-0ubuntu1
- 3:29.0.1-0ubuntu1.3
- 3:29.0.1-0ubuntu1.4
- 3:29.2.0-0ubuntu1
- 3:29.2.0-0ubuntu1.1
- 3:29.2.0-0ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 3:29.2.0-0ubuntu1.3
Update to 3:29.2.0-0ubuntu1.3
nova Ubuntu:25.10
- Versions
- 3:31.0.0-0ubuntu1
- 3:31.0.0+git2025070714.1c03429337-0ubuntu1
- 3:31.0.0+git2025070714.1c03429337-0ubuntu2
- 3:32.0.0~rc1-0ubuntu1
- 3:32.0.0-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 3:32.0.0-0ubuntu1.1
Update to 3:32.0.0-0ubuntu1.1
Original sources
- https://bugs.launchpad.net/nova/+bug/2137507
- https://www.openwall.com/lists/oss-security/2026/02/17/7
- https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
- https://access.redhat.com/security/cve/CVE-2026-24708
- https://bugzilla.redhat.com/show_bug.cgi?id=2430312
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24708.json
- https://access.redhat.com/errata/RHSA-2026:54757
- https://access.redhat.com/errata/RHSA-2026:66401
- https://access.redhat.com/errata/RHSA-2026:7884
- https://nvd.nist.gov/vuln/detail/CVE-2026-24708