snapshots are not being counted towards volume quota

I cannot create a 999GB volume because I already have a few small volumes and this would exceed my quota :-

cinder create 999 --display_name "gf_stb_quota_test_001" --display_description "gf_stb_quota_test_001"
ERROR: VolumeSizeExceedsAvailableQuota: Requested volume exceeds allowed volume size quota (HTTP 413) (Request-ID: req-982acca1-ff8a-483f-a329-822580295993)

BUT
I can proceed to create an 899GB volume and then take snapshots of same :-

cinder create 899 --display_name "gf_stb_quota_test_001" --display_description "gf_stb_quota_test_001"
cinder list
+--------------------------------------+-----------+--------------------------------+------+-------------+----------+-------------+
| b3523658-b78c-4762-968d-8e706c42d291 | available | gf_stb_quota_test_001 | 899 | None | false | |
+--------------------------------------+-----------+--------------------------------+------+-------------+----------+-------------+

cinder snapshot-create b3523658-b78c-4762-968d-8e706c42d291 --display-name "snap_gf_stb_quota_test_001" --display-description "snap_gf_stb_quota_test_001

cinder snapshot-list
+--------------------------------------+--------------------------------------+-----------+----------------------------+------+
| ID | Volume ID | Status | Display Name | Size |
+--------------------------------------+--------------------------------------+-----------+----------------------------+------+
| b4a7badc-ed79-4876-a2cb-4a8f0e7893a3 | b3523658-b78c-4762-968d-8e706c42d291 | available | snap_gf_stb_quota_test_001 | 899 |
+--------------------------------------+--------------------------------------+-----------+----------------------------+------+

I can continue making such snapshots to use up available storage in a denial-of-service attack since the snapshots are not being counted against my volume quota.

Hence I am also marking this bug as a scurity vulnerability.