Bug 2503670 (CVE-2026-71191)

Summary:	CVE-2026-71191 openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the S3API middleware of OpenStack Swift. The SigV4 presigned URL implementation does not require that semantic x-amz-* headers be included in the request signature. An attacker who obtains a presigned PUT URL can inject unsigned headers such as X-Amz-Copy-Source to copy objects from the signer's storage, bypassing the intended scope of the presigned URL authorization. The attacker needs prior knowledge of the target project_id, container name, and object name.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-07-28

Description OSIDB Bzimport 2026-07-21 15:10:12 UTC

A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causing a proxy worker to consume 100% CPU for an extended period. Because the regex evaluation runs at the C level, client disconnection does not interrupt the computation. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service for the Swift object storage cluster.

Affected versions: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3

Reporter: Christian Schwede (NVIDIA), reported via OpenStack VMT
PSIRT Ticket: PSIRTSUPT-19763
Upstream private report: https://launchpad.net/bugs/2158733