CVE-2026-71190 Details
Description
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
A denial-of-service vulnerability has been identified in OpenStack Swift proxy server versions through 2.38.0. The issue arises from the Accept header parser, which contains a regular expression susceptible to catastrophic backtracking. This flaw allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. The vulnerability can be exploited by sending a payload of 32 backslash-character pairs, which exceeds 30 seconds of CPU time. Once the header is received and parsing begins, disconnecting does not halt the processing, leading to a complete denial-of-service by exhausting all proxy worker threads.
Users can upgrade to OpenStack Swift versions 2.36.3, 2.37.2, or 2.38.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | CVE Modified | CVE |
| Aug 5, 2026 | New CVE Received | [email protected] |