CVE-2013-0270: Keystone: openstack keystone: denial of service via large http request with long tenant name

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-04-12 · updated 2026-07-30
Weakness: CWE-1284

Description

A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.

Affected products

OpenStack Keystone: from 2012.1 through 2012.1.3; from 2012.2 through 2012.2.4; 2013.1-milestone1, 2013.1-milestone2, 2013.1-milestone3

References

http://rhn.redhat.com/errata/RHSA-2013-0708.html
https://access.redhat.com/errata/RHSA-2013:0708
https://access.redhat.com/security/cve/CVE-2013-0270
https://bugs.launchpad.net/keystone/+bug/1099025
https://bugzilla.redhat.com/show_bug.cgi?id=909012
https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
https://launchpad.net/keystone/grizzly/2013.1
http://rhn.redhat.com/errata/RHSA-2013-0708.html
https://bugs.launchpad.net/keystone/+bug/1099025
https://bugzilla.redhat.com/show_bug.cgi?id=909012
https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8

Get alerted when CVE-2013-0270 or the next vulnerability affects your stack