Christian Schwede (NVIDIA) reported that the OpenStack Swift proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The vulnerability is in the Accept class in swift/common/swob.py, specifically in the qdtext character class definition at line 741. The regex defines qdtext as r'[^"]' (match any character except a double quote), and quoted_pair as r'(?:\\.)' (a backslash followed by any character). These are combined in an alternation: quoted_string = r'"(?:' + qdtext + r'|' + quoted_pair + r')*"'. Because backslash is not excluded from qdtext, any backslash in the input can match via either alternative, creating exponential ambiguity when the closing quote is missing. Processing time grows roughly as phi^n for n consecutive backslash-character pairs. A payload of ~27 backslash pairs causes ~10 seconds of CPU time per proxy worker.

The listing_formats middleware, which invokes Accept.best_match() via get_listing_content_type(), is positioned in the default proxy pipeline before tempauth/keystoneauth, meaning the vulnerable regex is evaluated before authentication on account and container GET/HEAD requests. Once the regex engine enters backtracking at the C level, the eventlet coroutine cannot be interrupted and client disconnection does not stop the computation. An attacker sending one request per worker can exhaust all proxy worker threads.

Affected versions: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3. The fix changes qdtext from r'[^"]' to r'[^"\\]', excluding backslashes from the general character class so they can only be consumed by the quoted_pair alternative, eliminating the ambiguity. Fix commit: 0ab3f8e7bc23276937e1b9f8881d006dd3446ab4 by Christian Schwede.

Reported via the OpenStack Vulnerability Management Team (Goutham Pacha Ravi). Original private report: https://launchpad.net/bugs/2158771