Skip to content
fr Sign in
7.1 High

CVE-2026-49017 In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated…

Description

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

Affected products and versions

Product Affected versions Fixed in
Swift 2.37 2.37.0 → < 2.37.2 2.37.2
Swift 2.36 2.36.0 → < 2.36.2 2.36.2
Swift 2.35 2.35.1 → < 2.35.3 2.35.3

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Swift

The 6 CVEs of Swift →
CVE-2026-97149 In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests 5.3 Medium CVE-2026-71192 In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From,… 6.0 Medium CVE-2026-71191 In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the… 6.0 Medium CVE-2026-71190 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to… 8.7 High
Track this CVE