UNKNOWN OpenStack
CVE-2026-49017
OSSA-2026-014: Swift proxy-server denial of service via truncated s3api chunked upload
Alistair Coles from NVIDIA reported a denial of service vulnerability in Swift’s s3api middleware. An authenticated user can send a truncated aws-chunked PUT request that causes a proxy-server worker to enter an infinite loop, consuming CPU and memory until the process becomes permanently unresponsive. Deployments running Swift 2.35.1 or later with the s3api middleware enabled are affected.
Affected Products
- Swift: >=2.35.1 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2
- CVE-2026-49017
References
- https://security.openstack.org/ossa/OSSA-2026-014.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-49017
This unknown severity vulnerability was published on 2026-05-27 via OpenStack. Affected: Swift: >=2.35.1 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2, CVE-2026-49017.
vulnfeed aggregates 9214 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.