CVE-2026-71190: Openstack OpenStack Swift vulnerability
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.) allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71190?
CVE-2026-71190 has a risk score of 71, indicating a significant security vulnerability.
How do I fix CVE-2026-71190?
To fix CVE-2026-71190, upgrade OpenStack Swift to version 2.38.1 or later.
What impact does CVE-2026-71190 have on OpenStack Swift?
CVE-2026-71190 allows unauthenticated remote attackers to exploit the proxy server, leading to potential denial of service due to high CPU usage.
Who is affected by CVE-2026-71190?
Any deployment of OpenStack Swift versions up to 2.38.0 is affected by CVE-2026-71190.
Is authentication required to exploit CVE-2026-71190?
No, CVE-2026-71190 can be exploited by unauthenticated users through crafted Accept headers.