Package
openstack-horizon-2026.1-fips
Component
oslo-messaging
Latest update
7.4
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The transport driver for the message broker omits the broker hostname when configuring TLS, so a certificate signed by the configured authority is accepted regardless of which host presented it. The corrected hostname verification has been merged to the maintained stable branch, but no point release has been tagged from that branch since the merge, so the fixed code is not available as a published artifact for this release series; the only released fix is on a newer major series outside this release constraint set.
Status
Impact
The vulnerable component is the Python package oslo-messaging (OpenStack oslo.messaging). Per the GitHub Security Advisory at https://github.com/advisories/GHSA-76qh-xr7q-h39m, there is no patched version for oslo-messaging (vulnerable range >=1.0.0,<=17.3.0). Upstream OpenStack oslo.messaging maintainers will need to release a fixed version of oslo-messaging in order to resolve this CVE.
Status