CVE-2026-71190
published 2026-08-05CVE-2026-71190: In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The…
PriorityP357high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.84%
57.3th percentile
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | swift | — | — |
| openstack | swift | >= 1.9.1 < 2.35.4 | 2.35.4 |
| openstack | swift | >= 2.36.0 < 2.36.3 | 2.36.3 |
| openstack | swift | >= 2.37.0 < 2.37.3 | 2.37.3 |
| rhoso | openstack-swift-account-rhel9 | — | — |
| rhoso | openstack-swift-base-rhel9 | — | — |
| rhoso | openstack-swift-container-rhel9 | — | — |
| rhoso | openstack-swift-object-rhel9 | — | — |
| rhoso | openstack-swift-proxy-server-rhel9 | — | — |
| rhosp-rhel8 | openstack-swift-account | — | — |
| rhosp-rhel8 | openstack-swift-base | — | — |
| rhosp-rhel8 | openstack-swift-container | — | — |
| rhosp-rhel8 | openstack-swift-object | — | — |
| rhosp-rhel8 | openstack-swift-proxy-server | — | — |
| rhosp-rhel9 | openstack-swift-account | — | — |
| rhosp-rhel9 | openstack-swift-base | — | — |
| rhosp-rhel9 | openstack-swift-container | — | — |
| rhosp-rhel9 | openstack-swift-object | — | — |
| rhosp-rhel9 | openstack-swift-proxy-server | — | — |
| rhosp13 | openstack-swift-account | — | — |
| rhosp13 | openstack-swift-base | — | — |
| rhosp13 | openstack-swift-container | — | — |
| rhosp13 | openstack-swift-object | — | — |
| rhosp13 | openstack-swift-proxy-server | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS).
ghsa_unreviewed·2026-08-05
CVE-2026-71190 [HIGH] CWE-1333 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS).
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
VulDB
OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 Accept Header Parser redos (Nessus ID 332251 / CNNVD-2026-71883530)
vuldb·2026-08-05·CVSS 8.7
CVE-2026-71190 [HIGH] OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0 Accept Header Parser redos (Nessus ID 332251 / CNNVD-2026-71883530)
A vulnerability labeled as critical has been found in OpenStack Swift up to 2.35.3/2.36.2/2.37.2/2.38.0. The affected element is an unknown function of the component Accept Header Parser. Such manipulation leads to inefficient regular expression complexity.
This vulnerability is listed as CVE-2026-71190. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
Red Hat
openstack-swift: openstack-swift: Unauthenticated denial of service via catastrophic backtracking in Accept header parser
vendor_redhat·2026-07-28·CVSS 8.7
CVE-2026-71190 [HIGH] CWE-1333 openstack-swift: openstack-swift: Unauthenticated denial of service via catastrophic backtracking in Accept header parser
openstack-swift: openstack-swift: Unauthenticated denial of service via catastrophic backtracking in Accept header parser
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-05
Published