Bug 2503670 (CVE-2026-71191) - CVE-2026-71191 openstack-swift: openstack-swift: S3API presigned URL unsigned header authorization bypass
Summary: CVE-2026-71191 openstack-swift: openstack-swift: S3API presigned URL unsigned...
Keywords:
Status: NEW
Alias: CVE-2026-71191
Deadline: 2026-07-28
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-21 15:10 UTC by OSIDB Bzimport
Modified: 2026-08-06 09:49 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-21 15:10:12 UTC 
A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causing a proxy worker to consume 100% CPU for an extended period. Because the regex evaluation runs at the C level, client disconnection does not interrupt the computation. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service for the Swift object storage cluster.

Affected versions: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3

Reporter: Christian Schwede (NVIDIA), reported via OpenStack VMT
PSIRT Ticket: PSIRTSUPT-19763
Upstream private report: https://launchpad.net/bugs/2158733
Note You need to log in before you can comment on or make changes to this bug.