CVE-2026-83536: OpenStack Network Exporter DoS Vulnerability

CVE-2026-83536 Overview

CVE-2026-83536 is a resource exhaustion vulnerability in openstack-network-exporter. The component ships an HTTP server configured without essential timeout settings, including ReadHeaderTimeout. An unauthenticated, remote attacker can open many slow HTTP header connections and trickle header bytes to hold sockets open indefinitely. This behavior exhausts server file descriptors and produces a Denial of Service (DoS) condition. Once file descriptors are depleted, legitimate Prometheus scrape requests fail, breaking metric collection and the alerting pipelines that depend on it. The flaw is categorized under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Remote unauthenticated attackers can disable Prometheus metric scraping and alerting by exhausting server file descriptors through slow HTTP header attacks (Slowloris-style).

Affected Products

openstack-network-exporter (all versions prior to the fixed release)
Red Hat OpenStack deployments that bundle openstack-network-exporter
Monitoring stacks relying on this exporter for Prometheus scraping

Discovery Timeline

2026-10-12 - CVE-2026-83536 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-83536

Vulnerability Analysis

The vulnerability resides in how openstack-network-exporter instantiates its HTTP server. Go's standard net/http package does not apply default timeouts when a server is constructed with zero-value fields. Without ReadHeaderTimeout, ReadTimeout, or IdleTimeout, a connection remains open as long as the client continues to send bytes, even one byte at a time.

An attacker exploits this by opening many TCP connections to the exporter's listening port and sending partial HTTP request headers at a slow cadence. Each connection consumes a file descriptor and a goroutine. Once the process reaches its file descriptor limit, the operating system refuses new connections, including those from legitimate Prometheus scrapers.

Because the exporter feeds alerting rules, loss of scrape availability can mask real operational incidents in the underlying OpenStack network layer during the DoS window.

Root Cause

The root cause is an insecure default configuration in the HTTP server initialization. The developer did not set ReadHeaderTimeout on the http.Server struct. This maps to CWE-400: Uncontrolled Resource Consumption. The server treats slow or stalled clients as valid long-lived connections and never reclaims the associated file descriptors.

Attack Vector

The attack is network-based, requires no authentication, and no user interaction. An attacker needs only reachability to the exporter's metrics endpoint. Using a Slowloris-style tool, the attacker opens hundreds or thousands of concurrent connections, writes a partial header line, and periodically appends a byte to keep each connection alive. The exporter accumulates connections until it cannot accept new ones, denying service to Prometheus.

The vulnerability mechanism is described in prose only, as no verified proof-of-concept code has been published. Refer to the Red Hat CVE-2026-83536 Advisory for additional context.

Detection Methods for CVE-2026-83536

Indicators of Compromise

Sudden spike in concurrent TCP connections to the openstack-network-exporter listening port from one or a small set of source IPs.
Rising file descriptor usage for the exporter process without a corresponding increase in legitimate scrape volume.
Prometheus up{job="openstack-network-exporter"} metric transitioning to 0 or scrape timeout errors in Prometheus logs.
Operating system log entries indicating accept: too many open files for the exporter process.

Detection Strategies

Monitor the exporter process file descriptor count via /proc/<pid>/fd or process_open_fds and alert on approach to RLIMIT_NOFILE.
Baseline normal concurrent connection counts to the metrics port and alert on deviations.
Inspect HTTP access logs for a high ratio of connections that never complete a full request within expected scrape intervals.

Monitoring Recommendations

Deploy network flow monitoring to flag long-lived, low-byte-rate TCP sessions targeting exporter ports.
Correlate Prometheus scrape failure alerts with host-level socket statistics (ss -s, netstat) to distinguish DoS from legitimate outages.
Forward exporter host telemetry and connection metadata to a centralized analytics platform for cross-host correlation.

How to Mitigate CVE-2026-83536

Immediate Actions Required

Restrict network access to the openstack-network-exporter metrics endpoint using firewall rules or security groups, allowing only Prometheus scraper IPs.
Place the exporter behind a reverse proxy such as nginx or envoy that enforces strict client_header_timeout and connection limits.
Lower the process RLIMIT_NOFILE cap to a predictable bound and monitor saturation, so file descriptor exhaustion is detected early.
Apply the vendor-supplied patch once available from Red Hat.

Patch Information

At publication, consult the Red Hat CVE-2026-83536 Advisory and Red Hat Bug Report #2526401 for the fixed package versions and errata. The upstream fix sets explicit ReadHeaderTimeout and related timeout fields on the http.Server instance.

Workarounds

Front the exporter with a reverse proxy that terminates slow connections, for example nginx with client_header_timeout 10s; and limit_conn directives.
Use network ACLs or Kubernetes NetworkPolicy to limit source addresses that can reach the exporter port.
Deploy connection rate-limiting at the host firewall level using iptablesconnlimit or nftables equivalents.

bash

# Example nginx reverse proxy snippet to mitigate slow-header DoS
server {
    listen 9436;
    client_header_timeout 10s;
    client_body_timeout 10s;
    send_timeout 10s;
    keepalive_timeout 15s;

    limit_conn_zone $binary_remote_addr zone=exporter_conn:10m;
    limit_conn exporter_conn 5;

    location /metrics {
        allow 10.0.0.0/24;   # Prometheus scraper subnet
        deny all;
        proxy_pass http://127.0.0.1:9437/metrics;
    }
}