Bug 2503395 (CVE-2026-71190)

Summary: CVE-2026-71190 openstack-swift: openstack-swift: Unauthenticated denial of service via catastrophic backtracking in Accept header parser
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causing a proxy worker to consume 100% CPU for an extended period. Because the regex evaluation runs at the C level, client disconnection does not interrupt the computation. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service for the Swift object storage cluster.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-07-28   

Description OSIDB Bzimport 2026-07-21 12:54:28 UTC 
Christian Schwede (NVIDIA) reported that the OpenStack Swift proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The vulnerability is in the Accept class in swift/common/swob.py, specifically in the qdtext character class definition at line 741. The regex defines qdtext as r'[^"]' (match any character except a double quote), and quoted_pair as r'(?:\\.)' (a backslash followed by any character). These are combined in an alternation: quoted_string = r'"(?:' + qdtext + r'|' + quoted_pair + r')*"'. Because backslash is not excluded from qdtext, any backslash in the input can match via either alternative, creating exponential ambiguity when the closing quote is missing. Processing time grows roughly as phi^n for n consecutive backslash-character pairs. A payload of ~27 backslash pairs causes ~10 seconds of CPU time per proxy worker.

The listing_formats middleware, which invokes Accept.best_match() via get_listing_content_type(), is positioned in the default proxy pipeline before tempauth/keystoneauth, meaning the vulnerable regex is evaluated before authentication on account and container GET/HEAD requests. Once the regex engine enters backtracking at the C level, the eventlet coroutine cannot be interrupted and client disconnection does not stop the computation. An attacker sending one request per worker can exhaust all proxy worker threads.

Affected versions: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3. The fix changes qdtext from r'[^"]' to r'[^"\\]', excluding backslashes from the general character class so they can only be consumed by the quoted_pair alternative, eliminating the ambiguity. Fix commit: 0ab3f8e7bc23276937e1b9f8881d006dd3446ab4 by Christian Schwede.

Reported via the OpenStack Vulnerability Management Team (Goutham Pacha Ravi). Original private report: https://launchpad.net/bugs/2158771