CVE-2026-71190
Received Received - Intake

ReDoS Vulnerability in OpenStack Swift Proxy Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: MITRE

Description
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71190
EUVD
EUVD-2026-53048

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openstack swift From 1.9.1 (inc) to 2.35.4 (exc)
openstack swift From 2.35.4 (inc) to 2.38.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71190 is a denial-of-service vulnerability in OpenStack Swift's proxy server caused by a flawed Accept header parser. The parser uses a regular expression vulnerable to catastrophic backtracking (ReDoS). An unauthenticated attacker can send a crafted Accept header with excessive backslashes, causing exponential CPU consumption in proxy workers. This exhausts all proxy threads, making the service unavailable.

Detection Guidance

Monitor proxy server CPU usage spikes during Accept header processing. Check for repeated requests with malformed Accept headers containing excessive backslashes. Inspect logs for proxy worker timeouts or crashes.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash OpenStack Swift proxy servers by sending specially crafted requests. The attack consumes all proxy worker threads, leading to complete service unavailability. Even low network traffic can saturate the proxy, disrupting access to stored objects and metadata.

Mitigation Strategies
  • Upgrade OpenStack Swift to fixed versions: 2.35.4, 2.36.3, 2.37.3, or 2.38.1 or later.
  • Apply patches provided for Swift branches 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and 2026.2/hibiscus.
  • Implement rate limiting on proxy servers to prevent excessive request processing.
  • Monitor network traffic for unusual Accept header patterns with high backslash counts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71190. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart