7.1
Élevée
CVE-2026-49017 In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated…
Description
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
Produits et versions touchés
Autres CVE de Swift
Les 6 CVE de Swift →
CVE-2026-97149
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests
5.3
Moyenne
CVE-2026-71192
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From,…
6.0
Moyenne
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the…
6.0
Moyenne
CVE-2026-71190
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to…
8.7
Élevée