CVE-2026-71190

Awaiting Analysis Awaiting Analysis - Queue

ReDoS Vulnerability in OpenStack Swift Proxy Server

Publication date: 2026-08-05

Last updated on: 2026-10-24

Assigner: MITRE

Description

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-10-24

Generated

2026-11-08

AI Q&A

2026-08-05

EPSS Evaluated

2026-11-07

NVD

CVE-2026-71190

EUVD

EUVD-2026-53048

Affected Vendors & Products

Vendor	Product	Version / Range
openstack	swift	From 1.9.1 (inc) to 2.35.4 (exc)
openstack	swift	From 2.35.4 (inc) to 2.38.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

CVE-2026-71190 is a denial-of-service vulnerability in OpenStack Swift's proxy server caused by a flawed Accept header parser. The parser uses a regular expression vulnerable to catastrophic backtracking (ReDoS). An unauthenticated attacker can send a crafted Accept header with excessive backslashes, causing exponential CPU consumption in proxy workers. This exhausts all proxy threads, making the service unavailable.

Detection Guidance

Monitor proxy server CPU usage spikes during Accept header processing. Check for repeated requests with malformed Accept headers containing excessive backslashes. Inspect logs for proxy worker timeouts or crashes.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash OpenStack Swift proxy servers by sending specially crafted requests. The attack consumes all proxy worker threads, leading to complete service unavailability. Even low network traffic can saturate the proxy, disrupting access to stored objects and metadata.

Compliance Impact

This vulnerability primarily causes service disruption by exhausting proxy worker threads through crafted Accept headers, leading to a denial of service. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged service unavailability could indirectly affect compliance by disrupting access to personal or health data, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade OpenStack Swift to fixed versions: 2.35.4, 2.36.3, 2.37.3, or 2.38.1 or later.
Apply patches provided for Swift branches 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and 2026.2/hibiscus.
Implement rate limiting on proxy servers to prevent excessive request processing.
Monitor network traffic for unusual Accept header patterns with high backslash counts.

Hi! I’m here to help you understand CVE-2026-71190. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...