UNKNOWN OpenStack
CVE-2026-71190
OSSA-2026-031: Swift proxy denial of service via Accept header
Christian Schwede from NVIDIA reported a denial of service vulnerability in Swift’s proxy server. The Accept header parser is vulnerable to catastrophic regular expression backtracking. An unauthenticated attacker can send crafted requests that exhaust proxy worker threads, rendering the service unavailable. All deployments running Swift proxy with versions between 1.9.1 and the fixed releases listed below are affected.
Affected Products
- Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
- CVE-2026-71190
References
- https://security.openstack.org/ossa/OSSA-2026-031.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-71190
This unknown severity vulnerability was published on 2026-07-28 via OpenStack. Affected: Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0, CVE-2026-71190.
vulnfeed aggregates 14156 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.