FIND-004 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).

http.Server{Addr: ..., Handler: mux, ErrorLog: ...} in main.go (lines 73-84) is constructed without ReadHeaderTimeout, ReadTimeout, WriteTimeout, or IdleTimeout. The promhttp handler's 2-second Timeout only starts after the request line and headers are fully parsed, so a client that trickles header bytes can hold a goroutine and file descriptor open indefinitely. Because the listener defaults to all interfaces (see FIND-003), an unauthenticated adjacent attacker can exhaust server FDs and block legitimate Prometheus scrapes. Flagged by gosec rule G112.

Attack pattern: Unauthenticated client opens many slow-header TCP connections to :1981, causing exporter file-descriptor exhaustion, which makes metrics scraping and alerting go blind.

Affected code: main.go:73-84

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium)

Remediation: Set ReadHeaderTimeout: 10*time.Second, ReadTimeout: 30*time.Second, WriteTimeout: 30*time.Second, IdleTimeout: 60*time.Second on the http.Server struct, or migrate to exporter-toolkit/web.ListenAndServe which applies sane defaults.