CVE-2026-49017 Details
Description
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
A denial-of-service vulnerability has been identified in OpenStack Swift versions prior to 2.36.2 and 2.37.2. The issue arises in the s3api middleware, which enters an infinite loop when processing a truncated aws-chunked PUT request. This loop is caused by the StreamingInput class, which repeatedly appends an empty buffer and re-reads, leading to unresponsiveness in the proxy-server worker handling the request. As a result, CPU and memory consumption increase, causing the worker to become permanently unresponsive. An authenticated attacker can exploit this vulnerability to systematically exhaust all proxy-server workers, causing a denial-of-service condition.
Users can upgrade to OpenStack Swift versions 2.36.2 or 2.37.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/27/9 | CVE | Mailing ListPatchThird Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/02/6 | CVE | Mailing ListPatchThird Party Advisory |
| https://bugs.launchpad.net/bugs/2152205 | [email protected] | Issue TrackingVendor Advisory |
| https://review.opendev.org/c/openstack/swift/+/987957 | [email protected] | Issue TrackingPatch |
| https://review.opendev.org/c/openstack/swift/+/988093 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openstack swift | >= 2.35.1, < 2.35.3 >= 2.36.0, < 2.36.2 >= 2.37.0, < 2.37.2 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CVE |
| May 27, 2026 | CVE Modified | CVE |
| May 27, 2026 | New CVE Received | [email protected] |