VYPR
← All advisories
High severityNVD Advisory· Published Sep 8, 2021· Updated Aug 4, 2024

CVE-2021-40797

CVE-2021-40797

Description

An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Authenticated users can cause memory leak in OpenStack Neutron API by requesting nonexistent controllers, leading to denial of service.

Vulnerability

A memory leak exists in the routes middleware of OpenStack Neutron. When an authenticated user sends API requests to nonexistent controllers (e.g., /v2.0/blabla), the API worker process accumulates memory without releasing it. This affects Neutron versions before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1 [1][2]. The issue was reported by Slawek Kaplonski of Red Hat [2].

Exploitation

An attacker with valid authentication credentials can repeatedly make HTTP requests to arbitrary, non-existent API endpoints on the Neutron API server. Each request triggers the memory leak, causing the worker process's memory consumption to increase. No special privileges beyond authentication are required, and the attack can be performed remotely over the network [2][3].

Impact

Successful exploitation leads to progressive memory exhaustion in the Neutron API worker process. This results in degraded API performance and, ultimately, a denial of service (DoS) condition where the API becomes unresponsive. The vulnerability does not allow data disclosure, modification, or remote code execution [1][2].

Mitigation

The vulnerability is fixed in Neutron versions 16.4.1, 17.2.1, and 18.1.1. Patches are available via OpenDev code reviews [2]. Users should upgrade to these or later versions. No workaround is documented; upgrading is the recommended mitigation [2][3].

References
  1. NVD - CVE-2021-40797
  2. security - [OSSA-2021-006] Neutron: Routes middleware memory leak for nonexistent controllers (CVE-2021-40797)
  3. Bug #1942179 “[OSSA-2021-006] Routes middleware memory leak for ...” : Bugs : neutron

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
neutronPyPI
< 16.4.116.4.1
neutronPyPI
>= 17.0.0, < 17.2.117.2.1
neutronPyPI
>= 18.0.0, < 18.1.118.1.1

Affected products

8

Patches

1
e610a5eb9e71

Don't use singleton in routes.middleware.RoutesMiddleware

https://github.com/openstack/neutronSlawek KaplonskiSep 3, 2021via ghsa
commit
1 file changed · +6 −1
  • neutron/api/extensions.py+6 −1 modified
    @@ -200,8 +200,13 @@ def __init__(self, application,
             controller = req_controllers[request_ext.key]
             controller.add_handler(request_ext.handler)
 
+        # NOTE(slaweq): It seems that using singleton=True in conjunction
+        # with eventlet monkey patching of the threading library doesn't work
+        # well and there is memory leak. See
+        # https://bugs.launchpad.net/neutron/+bug/1942179 for details
         self._router = routes.middleware.RoutesMiddleware(self._dispatch,
-                                                          mapper)
+                                                          mapper,
+                                                          singleton=False)
         super(ExtensionMiddleware, self).__init__(application)
 
     @classmethod

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.