CVE Feed

    Dashboard / CVE / CVE-2013-0270

    CVE-2013-0270

    A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.

    Published:Jan 13, 2013
    Last Modified:Jul 30, 2026
    EPS:Apr 12, 2013
    EPSS Score:0.03067
    CVSS Score:6.5

    Affected Products

    Vendor
    Openstack
    Product
    Keystone
    Vendor
    Redhat
    Product
    Openstack

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-80183 (CVSS 7.1) — In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every …
    CVE-2026-80184 (CVSS 7.6) — In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access to…
    CVE-2026-80182 (CVSS 7.6) — In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust…
    CVE-2026-2035364 (CVSS 8.1) — A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, appli…
    CVE-2026-42999 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call…
    CVE-2026-43000 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impe…
    CVE-2026-42998 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authenticatio…
    CVE-2026-44394 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism …
    CVE-2026-43001 (CVSS 7.9) — An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the ca…
    CVE-2026-40683 (CVSS 7.7) — In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to …

    References

    http://rhn.redhat.com/errata/RHSA-2013-0708.html
    https://access.redhat.com/errata/RHSA-2013:0708
    https://access.redhat.com/security/cve/CVE-2013-0270
    https://bugs.launchpad.net/keystone/+bug/1099025
    https://bugzilla.redhat.com/show_bug.cgi?id=909012
    https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
    https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
    https://launchpad.net/keystone/grizzly/2013.1
    http://rhn.redhat.com/errata/RHSA-2013-0708.html
    https://bugs.launchpad.net/keystone/+bug/1099025
    https://bugzilla.redhat.com/show_bug.cgi?id=909012
    https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
    https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
    https://launchpad.net/keystone/grizzly/2013.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High