{"cve":"CVE-2018-14635","nvd":{"published":"2018-09-10T19:29:00.313","modified":"2026-06-17T01:41:20.640","status":"Modified","description":"When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-20"],"references":["https://access.redhat.com/errata/RHSA-2018:2710","https://access.redhat.com/errata/RHSA-2018:2715","https://access.redhat.com/errata/RHSA-2018:2721","https://access.redhat.com/errata/RHSA-2018:3792","https://bugs.launchpad.net/neutron/+bug/1757482"],"products":["openstack:neutron","redhat:openstack"],"source":"nvd","synced_at":"2026-10-19T20:53:14.491561039+00:00"},"epss":{"cve":"CVE-2018-14635","score":0.02527,"percentile":0.84888,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-x634-34m9-96mp","url":"https://osv.dev/vulnerability/GHSA-x634-34m9-96mp","summary":"OpensStack Neutron Denial of Service Vulnerability","modified":"2024-09-25T21:00:51.908005Z","packages":[{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":[">=13.0.0.0b1 <13.0.0.0b2"],"fixed":["13.0.0.0b2"]},{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":["<11.0.6"],"fixed":["11.0.6"]},{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":[">=12.0.0 <12.0.4"],"fixed":["12.0.4"]}]},{"id":"PYSEC-2018-93","url":"https://osv.dev/vulnerability/PYSEC-2018-93","summary":"","modified":"2026-06-10T17:02:23.557363999Z","packages":[{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":["<11.0.6",">=12.0.0 <12.0.4"],"fixed":["11.0.6","12.0.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}