CVE-2014-9684: Openstack Image Registry And Delivery Service (glance)

Medium severity, CVSS 4.0. EPSS: 2% chance of exploitation in the next 30 days.

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.

Affected products

• Openstack Image Registry And Delivery Service (glance): version 2014.2 only; version 2014.2.1 only; version 2014.2.2 only

Published 2015-02-24. Last modified 2026-06-17.