PyPI/nova CVE-2026-24708: high 8.2, EPSS 0.42%
OpenStack Nova calls qemu-img without format restrictions for resize
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 30.2.1 |
| 31.0.0.0rc1 | - | 31.2.0 |
| 32.0.0.0rc1 | - | 32.1.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-2685
- https://nvd.nist.gov/vuln/detail/CVE-2026-24708
- https://github.com/openstack/nova/commit/3eba22ff09c81a61750fbb4882e5f1f01a20fdf5
- https://bugs.launchpad.net/nova/+bug/2137507
- https://github.com/openstack/nova
- https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
- https://www.openwall.com/lists/oss-security/2026/02/17/7
- https://pypi.org/project/nova
- https://github.com/advisories/GHSA-m4f3-qp2w-gwh6
CVE-2026-24708 · published · modified · JSON