{"url":"http://public2.vulnerablecode.io/api/packages/515900?format=json","purl":"pkg:deb/debian/neutron@2:8.1.2-1~bpo8%2B1","type":"deb","namespace":"debian","name":"neutron","version":"2:8.1.2-1~bpo8+1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"2:26.0.0-9+deb13u1","latest_non_vulnerable_version":"2:26.0.0-9+deb13u1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35848?format=json","vulnerability_id":"VCID-1444-3h31-3kdv","summary":"OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-38598.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-38598.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38598","reference_id":"","reference_type":"","scores":[{"value":"0.00138","scoring_system":"epss","scoring_elements":"0.33631","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00138","scoring_system":"epss","scoring_elements":"0.33562","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00138","scoring_system":"epss","scoring_elements":"0.33664","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00138","scoring_system":"epss","scoring_elements":"0.33677","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00138","scoring_system":"epss","scoring_elements":"0.33643","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00138","scoring_system":"epss","scoring_elements":"0.33609","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-38598"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38598","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38598"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/0a931391d8990f3e654b4bfda24ae4119c609bbf","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/0a931391d8990f3e654b4bfda24ae4119c609bbf"},{"reference_url":"https://github.com/openstack/neutron/commit/cc0d28a3e2ccfad6fc2ff24d78f009cbe3992575","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/cc0d28a3e2ccfad6fc2ff24d78f009cbe3992575"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-360.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-360.yaml"},{"reference_url":"https://launchpad.net/bugs/1938670","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://launchpad.net/bugs/1938670"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38598","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38598"},{"reference_url":"https://opendev.org/openstack/neutron/commit/fafa5dacd5057120562184a734e7345e7c0e9639","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"value":"8.8","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://opendev.org/openstack/neutron/commit/fafa5dacd5057120562184a734e7345e7c0e9639"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995273","reference_id":"1995273","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995273"},{"reference_url":"https://github.com/advisories/GHSA-hvm4-mc7m-22w4","reference_id":"GHSA-hvm4-mc7m-22w4","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hvm4-mc7m-22w4"},{"reference_url":"https://usn.ubuntu.com/6067-1/","reference_id":"USN-6067-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6067-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/510472?format=json","purl":"pkg:deb/debian/neutron@2:17.2.1-0%2Bdeb11u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ecp9-x6p6-7fa2"},{"vulnerability":"VCID-hzer-w69h-uyah"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:17.2.1-0%252Bdeb11u1"}],"aliases":["CVE-2021-38598","GHSA-hvm4-mc7m-22w4","PYSEC-2021-360"],"risk_score":4.1,"exploitability":"0.5","weighted_severity":"8.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-1444-3h31-3kdv"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35863?format=json","vulnerability_id":"VCID-69mn-brsx-xydy","summary":"An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-40797.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-40797.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40797","reference_id":"","reference_type":"","scores":[{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.72311","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.72273","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.72315","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.72321","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.723","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00694","scoring_system":"epss","scoring_elements":"0.72286","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40797"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40797","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40797"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/e610a5eb9e71aa2549fb11e2139370d227787da2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/e610a5eb9e71aa2549fb11e2139370d227787da2"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-329.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-329.yaml"},{"reference_url":"https://launchpad.net/bugs/1942179","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://launchpad.net/bugs/1942179"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40797","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40797"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2021-006.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2021-006.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/09/09/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2021/09/09/2"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003248","reference_id":"2003248","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003248"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994202","reference_id":"994202","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994202"},{"reference_url":"https://github.com/advisories/GHSA-cpx3-696p-3cw9","reference_id":"GHSA-cpx3-696p-3cw9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cpx3-696p-3cw9"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0990","reference_id":"RHSA-2022:0990","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0990"},{"reference_url":"https://access.redhat.com/errata/RHSA-2022:0996","reference_id":"RHSA-2022:0996","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2022:0996"},{"reference_url":"https://usn.ubuntu.com/6067-1/","reference_id":"USN-6067-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6067-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/510472?format=json","purl":"pkg:deb/debian/neutron@2:17.2.1-0%2Bdeb11u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ecp9-x6p6-7fa2"},{"vulnerability":"VCID-hzer-w69h-uyah"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:17.2.1-0%252Bdeb11u1"}],"aliases":["CVE-2021-40797","GHSA-cpx3-696p-3cw9","PYSEC-2021-329"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-69mn-brsx-xydy"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43980?format=json","vulnerability_id":"VCID-6mxz-st39-zyh3","summary":"OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism\nThe IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1473","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2016:1473"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1474","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2016:1474"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8914.json","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8914.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8914","reference_id":"","reference_type":"","scores":[{"value":"0.06657","scoring_system":"epss","scoring_elements":"0.91379","published_at":"2026-06-04T12:55:00Z"},{"value":"0.06657","scoring_system":"epss","scoring_elements":"0.91401","published_at":"2026-06-09T12:55:00Z"},{"value":"0.06657","scoring_system":"epss","scoring_elements":"0.91387","published_at":"2026-06-08T12:55:00Z"},{"value":"0.06657","scoring_system":"epss","scoring_elements":"0.91391","published_at":"2026-06-07T12:55:00Z"},{"value":"0.06657","scoring_system":"epss","scoring_elements":"0.91395","published_at":"2026-06-06T12:55:00Z"},{"value":"0.06657","scoring_system":"epss","scoring_elements":"0.91393","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8914"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1502933","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1502933"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8914","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8914"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/1d1159bb2b57f0b4193f8666f53736f05bf7eac9","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/openstack/neutron/commit/1d1159bb2b57f0b4193f8666f53736f05bf7eac9"},{"reference_url":"https://github.com/openstack/neutron/commit/3e66b1a87544d7a127abceec13bfeacb8f18f7e1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/openstack/neutron/commit/3e66b1a87544d7a127abceec13bfeacb8f18f7e1"},{"reference_url":"https://review.openstack.org/#/c/300233","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/300233"},{"reference_url":"https://review.openstack.org/#/c/310648","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/310648"},{"reference_url":"https://review.openstack.org/#/c/310652","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/310652"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2016-009.html","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2016-009.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/06/10/5","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/06/10/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/06/10/6","reference_id":"","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/06/10/6"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345892","reference_id":"1345892","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345892"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8914","reference_id":"CVE-2015-8914","reference_type":"","scores":[{"value":"9.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8914"},{"reference_url":"https://github.com/advisories/GHSA-3vj4-cvjp-482h","reference_id":"GHSA-3vj4-cvjp-482h","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3vj4-cvjp-482h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/515901?format=json","purl":"pkg:deb/debian/neutron@2:9.1.1-3%2Bdeb9u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:9.1.1-3%252Bdeb9u1"}],"aliases":["CVE-2015-8914","GHSA-3vj4-cvjp-482h"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6mxz-st39-zyh3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44060?format=json","vulnerability_id":"VCID-cwwz-4a6e-tugg","summary":"OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism\nThe IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1473","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2016:1473"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1474","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2016:1474"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5362.json","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5362.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5362","reference_id":"","reference_type":"","scores":[{"value":"0.0631","scoring_system":"epss","scoring_elements":"0.91115","published_at":"2026-06-04T12:55:00Z"},{"value":"0.0631","scoring_system":"epss","scoring_elements":"0.91138","published_at":"2026-06-09T12:55:00Z"},{"value":"0.0631","scoring_system":"epss","scoring_elements":"0.91121","published_at":"2026-06-08T12:55:00Z"},{"value":"0.0631","scoring_system":"epss","scoring_elements":"0.91125","published_at":"2026-06-07T12:55:00Z"},{"value":"0.0631","scoring_system":"epss","scoring_elements":"0.91127","published_at":"2026-06-06T12:55:00Z"},{"value":"0.0631","scoring_system":"epss","scoring_elements":"0.91128","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5362"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1558658","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1558658"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5362","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5362"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://review.openstack.org/#/c/300202","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/300202"},{"reference_url":"https://review.openstack.org/#/c/303563","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/303563"},{"reference_url":"https://review.openstack.org/#/c/303572","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/303572"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2016-009.html","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2016-009.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/06/10/5","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/06/10/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/06/10/6","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/06/10/6"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345889","reference_id":"1345889","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345889"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5362","reference_id":"CVE-2016-5362","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5362"},{"reference_url":"https://github.com/advisories/GHSA-qpwc-p365-pqrr","reference_id":"GHSA-qpwc-p365-pqrr","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qpwc-p365-pqrr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/515901?format=json","purl":"pkg:deb/debian/neutron@2:9.1.1-3%2Bdeb9u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:9.1.1-3%252Bdeb9u1"}],"aliases":["CVE-2016-5362","GHSA-qpwc-p365-pqrr"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cwwz-4a6e-tugg"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35258?format=json","vulnerability_id":"VCID-jecq-8kqy-sfg8","summary":"When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2018:2710","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2018:2710"},{"reference_url":"https://access.redhat.com/errata/RHSA-2018:2715","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2018:2715"},{"reference_url":"https://access.redhat.com/errata/RHSA-2018:2721","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2018:2721"},{"reference_url":"https://access.redhat.com/errata/RHSA-2018:3792","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2018:3792"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14635.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14635.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14635","reference_id":"","reference_type":"","scores":[{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.5414","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54193","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54172","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54195","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54205","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00306","scoring_system":"epss","scoring_elements":"0.54197","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14635"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1757482","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1757482"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14635","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14635"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14635","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14635"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/54aa6e81cb17b33ce4d5d469cc11dec2869c762d","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/54aa6e81cb17b33ce4d5d469cc11dec2869c762d"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-93.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-93.yaml"},{"reference_url":"https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1607822","reference_id":"1607822","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1607822"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14635","reference_id":"CVE-2018-14635","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14635"},{"reference_url":"https://github.com/advisories/GHSA-x634-34m9-96mp","reference_id":"GHSA-x634-34m9-96mp","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x634-34m9-96mp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/516247?format=json","purl":"pkg:deb/debian/neutron@2:13.0.7%2Bgit.2021.09.27.bace3d1890-0%2Bdeb10u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:13.0.7%252Bgit.2021.09.27.bace3d1890-0%252Bdeb10u1"}],"aliases":["CVE-2018-14635","GHSA-x634-34m9-96mp","PYSEC-2018-93"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jecq-8kqy-sfg8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44116?format=json","vulnerability_id":"VCID-m7vh-gw28-wbas","summary":"OpenStack Neutron Intended MAC-spoofing protection mechanism bypass\nThe IPTables firewall in OpenStack Neutron up to 7.0.4 and 8.x before 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1473","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2016:1473"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1474","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2016:1474"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5363.json","reference_id":"","reference_type":"","scores":[{"value":"6.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-5363.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5363","reference_id":"","reference_type":"","scores":[{"value":"0.04749","scoring_system":"epss","scoring_elements":"0.8965","published_at":"2026-06-09T12:55:00Z"},{"value":"0.04749","scoring_system":"epss","scoring_elements":"0.89617","published_at":"2026-06-04T12:55:00Z"},{"value":"0.04749","scoring_system":"epss","scoring_elements":"0.89634","published_at":"2026-06-06T12:55:00Z"},{"value":"0.04749","scoring_system":"epss","scoring_elements":"0.89633","published_at":"2026-06-07T12:55:00Z"},{"value":"0.04749","scoring_system":"epss","scoring_elements":"0.89635","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-5363"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1558658","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1558658"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5363","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5363"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/5853af9cba6733725d6c9ac0db644f426713f0cf","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/5853af9cba6733725d6c9ac0db644f426713f0cf"},{"reference_url":"https://github.com/openstack/neutron/commit/6a93ee8ac1a901c255e3475a24f1afc11d8bf80f","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/6a93ee8ac1a901c255e3475a24f1afc11d8bf80f"},{"reference_url":"https://github.com/openstack/neutron/commit/997d7b03fb7f5528f0a3ce70867b9dcd9321509e","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/997d7b03fb7f5528f0a3ce70867b9dcd9321509e"},{"reference_url":"https://github.com/openstack/neutron/commit/fd5fd259a02156babdfcb12f66cde6ec9e7274ae","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/fd5fd259a02156babdfcb12f66cde6ec9e7274ae"},{"reference_url":"https://review.openstack.org/#/c/299021","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/299021"},{"reference_url":"https://review.openstack.org/#/c/299023","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/299023"},{"reference_url":"https://review.openstack.org/#/c/299025","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/c/299025"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2016-009.html","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2016-009.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/06/10/5","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/06/10/5"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/06/10/6","reference_id":"","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2016/06/10/6"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345891","reference_id":"1345891","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1345891"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5363","reference_id":"CVE-2016-5363","reference_type":"","scores":[{"value":"8.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5363"},{"reference_url":"https://github.com/advisories/GHSA-9pp3-cvmq-9p22","reference_id":"GHSA-9pp3-cvmq-9p22","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9pp3-cvmq-9p22"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/515901?format=json","purl":"pkg:deb/debian/neutron@2:9.1.1-3%2Bdeb9u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:9.1.1-3%252Bdeb9u1"}],"aliases":["CVE-2016-5363","GHSA-9pp3-cvmq-9p22"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m7vh-gw28-wbas"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35259?format=json","vulnerability_id":"VCID-mcet-nkj3-bug8","summary":"Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14636.json","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14636.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14636","reference_id":"","reference_type":"","scores":[{"value":"0.00203","scoring_system":"epss","scoring_elements":"0.42307","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00203","scoring_system":"epss","scoring_elements":"0.42299","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00203","scoring_system":"epss","scoring_elements":"0.42333","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00203","scoring_system":"epss","scoring_elements":"0.42273","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00203","scoring_system":"epss","scoring_elements":"0.42359","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00203","scoring_system":"epss","scoring_elements":"0.42348","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-14636"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1734320","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1734320"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1767422","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1767422"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14636","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14636"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2018-94.yaml"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594977","reference_id":"1594977","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594977"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14636","reference_id":"CVE-2018-14636","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"6.0","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14636"},{"reference_url":"https://github.com/advisories/GHSA-8q95-jj7p-x93x","reference_id":"GHSA-8q95-jj7p-x93x","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8q95-jj7p-x93x"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/516247?format=json","purl":"pkg:deb/debian/neutron@2:13.0.7%2Bgit.2021.09.27.bace3d1890-0%2Bdeb10u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:13.0.7%252Bgit.2021.09.27.bace3d1890-0%252Bdeb10u1"}],"aliases":["CVE-2018-14636","GHSA-8q95-jj7p-x93x","PYSEC-2018-94"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mcet-nkj3-bug8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35343?format=json","vulnerability_id":"VCID-p5ww-51mu-buf5","summary":"An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2019:0879","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2019:0879"},{"reference_url":"https://access.redhat.com/errata/RHSA-2019:0935","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2019:0935"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-10876.json","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-10876.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10876","reference_id":"","reference_type":"","scores":[{"value":"0.00624","scoring_system":"epss","scoring_elements":"0.70588","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00624","scoring_system":"epss","scoring_elements":"0.70542","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00624","scoring_system":"epss","scoring_elements":"0.70585","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00624","scoring_system":"epss","scoring_elements":"0.70594","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00624","scoring_system":"epss","scoring_elements":"0.70576","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00624","scoring_system":"epss","scoring_elements":"0.70564","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10876"},{"reference_url":"https://bugs.launchpad.net/ossa/+bug/1813007","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/ossa/+bug/1813007"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10876","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10876"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2019-189.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2019-189.yaml"},{"reference_url":"https://review.openstack.org/#/q/topic:bug/1813007","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://review.openstack.org/#/q/topic:bug/1813007"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2019-002.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2019-002.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/04/09/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2019/04/09/2"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695883","reference_id":"1695883","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695883"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926502","reference_id":"926502","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926502"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10876","reference_id":"CVE-2019-10876","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10876"},{"reference_url":"https://github.com/advisories/GHSA-jr9m-v5qh-mh2j","reference_id":"GHSA-jr9m-v5qh-mh2j","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jr9m-v5qh-mh2j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/516247?format=json","purl":"pkg:deb/debian/neutron@2:13.0.7%2Bgit.2021.09.27.bace3d1890-0%2Bdeb10u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:13.0.7%252Bgit.2021.09.27.bace3d1890-0%252Bdeb10u1"}],"aliases":["CVE-2019-10876","GHSA-jr9m-v5qh-mh2j","PYSEC-2019-189"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p5ww-51mu-buf5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35856?format=json","vulnerability_id":"VCID-p6g8-396q-t7ck","summary":"An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-40085.json","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-40085.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40085","reference_id":"","reference_type":"","scores":[{"value":"0.01348","scoring_system":"epss","scoring_elements":"0.80461","published_at":"2026-06-09T12:55:00Z"},{"value":"0.01348","scoring_system":"epss","scoring_elements":"0.8042","published_at":"2026-06-04T12:55:00Z"},{"value":"0.01348","scoring_system":"epss","scoring_elements":"0.80446","published_at":"2026-06-05T12:55:00Z"},{"value":"0.01348","scoring_system":"epss","scoring_elements":"0.80448","published_at":"2026-06-06T12:55:00Z"},{"value":"0.01348","scoring_system":"epss","scoring_elements":"0.80445","published_at":"2026-06-07T12:55:00Z"},{"value":"0.01348","scoring_system":"epss","scoring_elements":"0.8044","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-40085"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40085","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40085"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/df891f0593d234e01f27d7c0376d9702e178ecfb","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/df891f0593d234e01f27d7c0376d9702e178ecfb"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-361.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-361.yaml"},{"reference_url":"https://launchpad.net/bugs/1939733","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://launchpad.net/bugs/1939733"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00005.html"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00038.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00038.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40085","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40085"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2021-005.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2021-005.html"},{"reference_url":"https://www.debian.org/security/2021/dsa-4983","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2021/dsa-4983"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/08/31/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2021/08/31/2"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998052","reference_id":"1998052","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998052"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993398","reference_id":"993398","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993398"},{"reference_url":"https://github.com/advisories/GHSA-fh73-gjvg-349c","reference_id":"GHSA-fh73-gjvg-349c","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-fh73-gjvg-349c"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3481","reference_id":"RHSA-2021:3481","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3481"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3488","reference_id":"RHSA-2021:3488","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3488"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3502","reference_id":"RHSA-2021:3502","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3502"},{"reference_url":"https://access.redhat.com/errata/RHSA-2021:3503","reference_id":"RHSA-2021:3503","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2021:3503"},{"reference_url":"https://usn.ubuntu.com/6067-1/","reference_id":"USN-6067-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6067-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/516247?format=json","purl":"pkg:deb/debian/neutron@2:13.0.7%2Bgit.2021.09.27.bace3d1890-0%2Bdeb10u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:13.0.7%252Bgit.2021.09.27.bace3d1890-0%252Bdeb10u1"},{"url":"http://public2.vulnerablecode.io/api/packages/510472?format=json","purl":"pkg:deb/debian/neutron@2:17.2.1-0%2Bdeb11u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ecp9-x6p6-7fa2"},{"vulnerability":"VCID-hzer-w69h-uyah"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:17.2.1-0%252Bdeb11u1"}],"aliases":["CVE-2021-40085","GHSA-fh73-gjvg-349c","PYSEC-2021-361"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p6g8-396q-t7ck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35330?format=json","vulnerability_id":"VCID-t5sb-ghkg-zbb6","summary":"An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security group rule along with a protocol that doesn't support that option (for example, VRRP), an authenticated user may block further application of security group rules for instances from any project/tenant on the compute hosts to which it's applied. (Only deployments using the iptables security group driver are affected.)","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2019:0879","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2019:0879"},{"reference_url":"https://access.redhat.com/errata/RHSA-2019:0916","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2019:0916"},{"reference_url":"https://access.redhat.com/errata/RHSA-2019:0935","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2019:0935"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9735.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9735.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9735","reference_id":"","reference_type":"","scores":[{"value":"0.01892","scoring_system":"epss","scoring_elements":"0.83564","published_at":"2026-06-05T12:55:00Z"},{"value":"0.01892","scoring_system":"epss","scoring_elements":"0.83566","published_at":"2026-06-06T12:55:00Z"},{"value":"0.01892","scoring_system":"epss","scoring_elements":"0.83562","published_at":"2026-06-07T12:55:00Z"},{"value":"0.01892","scoring_system":"epss","scoring_elements":"0.83554","published_at":"2026-06-08T12:55:00Z"},{"value":"0.01892","scoring_system":"epss","scoring_elements":"0.83568","published_at":"2026-06-09T12:55:00Z"},{"value":"0.01892","scoring_system":"epss","scoring_elements":"0.83539","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-9735"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9735","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9735"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2019-190.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2019-190.yaml"},{"reference_url":"https://launchpad.net/bugs/1818385","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://launchpad.net/bugs/1818385"},{"reference_url":"https://seclists.org/bugtraq/2019/Mar/24","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://seclists.org/bugtraq/2019/Mar/24"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2019-001.html","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2019-001.html"},{"reference_url":"https://usn.ubuntu.com/4036-1","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://usn.ubuntu.com/4036-1"},{"reference_url":"https://usn.ubuntu.com/4036-1/","reference_id":"","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/4036-1/"},{"reference_url":"https://web.archive.org/web/20201208185619/http://www.securityfocus.com/bid/107390","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20201208185619/http://www.securityfocus.com/bid/107390"},{"reference_url":"https://www.debian.org/security/2019/dsa-4409","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4409"},{"reference_url":"http://www.openwall.com/lists/oss-security/2019/03/18/2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2019/03/18/2"},{"reference_url":"http://www.securityfocus.com/bid/107390","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/107390"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690745","reference_id":"1690745","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690745"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924508","reference_id":"924508","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=924508"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9735","reference_id":"CVE-2019-9735","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9735"},{"reference_url":"https://github.com/advisories/GHSA-9773-3fqg-8w25","reference_id":"GHSA-9773-3fqg-8w25","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9773-3fqg-8w25"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/515901?format=json","purl":"pkg:deb/debian/neutron@2:9.1.1-3%2Bdeb9u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:9.1.1-3%252Bdeb9u1"},{"url":"http://public2.vulnerablecode.io/api/packages/516247?format=json","purl":"pkg:deb/debian/neutron@2:13.0.7%2Bgit.2021.09.27.bace3d1890-0%2Bdeb10u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:13.0.7%252Bgit.2021.09.27.bace3d1890-0%252Bdeb10u1"}],"aliases":["CVE-2019-9735","GHSA-9773-3fqg-8w25","PYSEC-2019-190"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t5sb-ghkg-zbb6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35812?format=json","vulnerability_id":"VCID-wa91-gzx6-h7gu","summary":"A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20267.json","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20267.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20267","reference_id":"","reference_type":"","scores":[{"value":"0.00126","scoring_system":"epss","scoring_elements":"0.31461","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00126","scoring_system":"epss","scoring_elements":"0.31472","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00126","scoring_system":"epss","scoring_elements":"0.31539","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00126","scoring_system":"epss","scoring_elements":"0.31505","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00126","scoring_system":"epss","scoring_elements":"0.31468","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00126","scoring_system":"epss","scoring_elements":"0.31436","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-20267"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934330","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934330"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20267","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20267"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-136.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/neutron/PYSEC-2021-136.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20267","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20267"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2021-001.html","reference_id":"","reference_type":"","scores":[{"value":"7.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"},{"value":"7.1","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2021-001.html"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985104","reference_id":"985104","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985104"},{"reference_url":"https://github.com/advisories/GHSA-w8hx-f868-pvch","reference_id":"GHSA-w8hx-f868-pvch","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w8hx-f868-pvch"},{"reference_url":"https://usn.ubuntu.com/6067-1/","reference_id":"USN-6067-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6067-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/510472?format=json","purl":"pkg:deb/debian/neutron@2:17.2.1-0%2Bdeb11u1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ecp9-x6p6-7fa2"},{"vulnerability":"VCID-hzer-w69h-uyah"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:17.2.1-0%252Bdeb11u1"}],"aliases":["CVE-2021-20267","GHSA-w8hx-f868-pvch","PYSEC-2021-136"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wa91-gzx6-h7gu"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/94853?format=json","vulnerability_id":"VCID-3dqh-f7uy-mkhp","summary":"Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.","references":[{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-1909.html","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-1909.html"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:1909","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2015:1909"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5240.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5240.json"},{"reference_url":"https://access.redhat.com/security/cve/CVE-2015-5240","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/security/cve/CVE-2015-5240"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5240","reference_id":"","reference_type":"","scores":[{"value":"0.00128","scoring_system":"epss","scoring_elements":"0.31762","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00174","scoring_system":"epss","scoring_elements":"0.38682","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00174","scoring_system":"epss","scoring_elements":"0.38626","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00174","scoring_system":"epss","scoring_elements":"0.38679","published_at":"2026-06-05T12:55:00Z"},{"value":"0.00174","scoring_system":"epss","scoring_elements":"0.38636","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00174","scoring_system":"epss","scoring_elements":"0.38654","published_at":"2026-06-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-5240"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1489111","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1489111"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1258458","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1258458"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5240","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5240"},{"reference_url":"https://github.com/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron"},{"reference_url":"https://github.com/openstack/neutron/commit/767cea23de44a963c6793ffe30ea5c6827d27a38","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/767cea23de44a963c6793ffe30ea5c6827d27a38"},{"reference_url":"https://github.com/openstack/neutron/commit/bbca973986fdc99eae9d1b2545e8246c0b2be2e2","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/bbca973986fdc99eae9d1b2545e8246c0b2be2e2"},{"reference_url":"https://github.com/openstack/neutron/commit/fdc3431ccd219accf6a795079d9b67b8656eed8e","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/openstack/neutron/commit/fdc3431ccd219accf6a795079d9b67b8656eed8e"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5240","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5240"},{"reference_url":"https://security.openstack.org/ossa/OSSA-2015-018.html","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.openstack.org/ossa/OSSA-2015-018.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2015/09/08/9","reference_id":"","reference_type":"","scores":[{"value":"LOW","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2015/09/08/9"},{"reference_url":"https://github.com/advisories/GHSA-hhpj-6pj7-wpx5","reference_id":"GHSA-hhpj-6pj7-wpx5","reference_type":"","scores":[{"value":"LOW","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-hhpj-6pj7-wpx5"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/515900?format=json","purl":"pkg:deb/debian/neutron@2:8.1.2-1~bpo8%2B1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-6mxz-st39-zyh3"},{"vulnerability":"VCID-cwwz-4a6e-tugg"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-m7vh-gw28-wbas"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:8.1.2-1~bpo8%252B1"}],"aliases":["CVE-2015-5240","GHSA-hhpj-6pj7-wpx5"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3dqh-f7uy-mkhp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43981?format=json","vulnerability_id":"VCID-n4sa-8h57-xkfu","summary":"Improper Input Validation\nA Denial-of-Service flaw was found in the OpenStack Networking (neutron) L2 agent when using the iptables firewall driver. By submitting an address pair that is rejected as invalid by the ipset tool (with zero prefix size), an authenticated attacker can cause the L2 agent to crash.","references":[{"reference_url":"http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://lists.openstack.org/pipermail/openstack-announce/2015-June/000377.html"},{"reference_url":"http://rhn.redhat.com/errata/RHSA-2015-1680.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://rhn.redhat.com/errata/RHSA-2015-1680.html"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:1680","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/errata/RHSA-2015:1680"},{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-3221.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-3221.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3221","reference_id":"","reference_type":"","scores":[{"value":"0.14311","scoring_system":"epss","scoring_elements":"0.94547","published_at":"2026-06-09T12:55:00Z"},{"value":"0.14311","scoring_system":"epss","scoring_elements":"0.9453","published_at":"2026-06-04T12:55:00Z"},{"value":"0.14311","scoring_system":"epss","scoring_elements":"0.94538","published_at":"2026-06-05T12:55:00Z"},{"value":"0.14311","scoring_system":"epss","scoring_elements":"0.9454","published_at":"2026-06-06T12:55:00Z"},{"value":"0.14311","scoring_system":"epss","scoring_elements":"0.94542","published_at":"2026-06-07T12:55:00Z"},{"value":"0.14311","scoring_system":"epss","scoring_elements":"0.94543","published_at":"2026-06-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-3221"},{"reference_url":"https://bugs.launchpad.net/neutron/+bug/1461054","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugs.launchpad.net/neutron/+bug/1461054"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1232284","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1232284"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3221","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3221"},{"reference_url":"https://git.openstack.org/cgit/openstack/neutron/commit/?id=9ff6138c47c95034ba845e9448ddffd147b51f38","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://git.openstack.org/cgit/openstack/neutron/commit/?id=9ff6138c47c95034ba845e9448ddffd147b51f38"},{"reference_url":"https://opendev.org/openstack/neutron","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://opendev.org/openstack/neutron"},{"reference_url":"https://web.archive.org/web/20200228084753/http://www.securityfocus.com/bid/75368","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20200228084753/http://www.securityfocus.com/bid/75368"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=789713","reference_id":"789713","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=789713"},{"reference_url":"https://access.redhat.com/security/cve/CVE-2015-3221","reference_id":"CVE-2015-3221","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://access.redhat.com/security/cve/CVE-2015-3221"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3221","reference_id":"CVE-2015-3221","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3221"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/37360.txt","reference_id":"CVE-2015-5066;CVE-2015-3221;OSVDB-123599","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/37360.txt"},{"reference_url":"https://github.com/advisories/GHSA-wf44-4mgj-rwvx","reference_id":"GHSA-wf44-4mgj-rwvx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wf44-4mgj-rwvx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/515900?format=json","purl":"pkg:deb/debian/neutron@2:8.1.2-1~bpo8%2B1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1444-3h31-3kdv"},{"vulnerability":"VCID-69mn-brsx-xydy"},{"vulnerability":"VCID-6mxz-st39-zyh3"},{"vulnerability":"VCID-cwwz-4a6e-tugg"},{"vulnerability":"VCID-jecq-8kqy-sfg8"},{"vulnerability":"VCID-m7vh-gw28-wbas"},{"vulnerability":"VCID-mcet-nkj3-bug8"},{"vulnerability":"VCID-p5ww-51mu-buf5"},{"vulnerability":"VCID-p6g8-396q-t7ck"},{"vulnerability":"VCID-t5sb-ghkg-zbb6"},{"vulnerability":"VCID-wa91-gzx6-h7gu"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:8.1.2-1~bpo8%252B1"}],"aliases":["CVE-2015-3221","GHSA-wf44-4mgj-rwvx"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n4sa-8h57-xkfu"}],"risk_score":"4.5","resource_url":"http://public2.vulnerablecode.io/packages/pkg:deb/debian/neutron@2:8.1.2-1~bpo8%252B1"}