Errata 1 for OSSA-2026-031: CVE-2026-71190 has been assigned.
============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ==============================================================
:Date: July 28, 2026 :CVE: CVE-2026-71190
Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description ~~~~~~~~~~~ Errata ~~~~~~ CVE-2026-71190 has been assigned for this vulnerability.
Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Christian Schwede from NVIDIA
References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71190
OSSA History ~~~~~~~~~~~~ - 2026-08-05 - Errata 1 - 2026-07-28 - Original Version
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
On 7/28/26 8:28 AM, Goutham Pacha Ravi wrote: ============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ==============================================================
:Date: July 28, 2026 :CVE: CVE-2026-pending
Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Christian Schwede from NVIDIA
References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
====================================================== OSSA-2026-030: Swift S3API header authorization bypass ======================================================
:Date: July 28, 2026 :CVE: CVE-2026-71191, CVE-2026-71192
Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description ~~~~~~~~~~~ Errata ~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Christian Schwede from NVIDIA
References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71191 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71192
OSSA History ~~~~~~~~~~~~ - 2026-08-05 - Errata 1 - 2026-07-28 - Original Version
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
On 7/28/26 8:27 AM, Goutham Pacha Ravi wrote: ====================================================== OSSA-2026-030: Swift S3API header authorization bypass ======================================================
:Date: July 28, 2026 :CVE: CVE-2026-pending, CVE-2026-pending
Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Christian Schwede from NVIDIA
References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target projectid, container name, and object name are known. This affects all deployments using the default s3acl=false configuration.
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.) allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ==============================================================
:Date: July 28, 2026 :CVE: CVE-2026-pending
Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Christian Schwede from NVIDIA
References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
====================================================== OSSA-2026-030: Swift S3API header authorization bypass ======================================================
:Date: July 28, 2026 :CVE: CVE-2026-pending, CVE-2026-pending
Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0
Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Christian Schwede from NVIDIA
References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.
OpenStack Security Advisory: OSSA-2026-024 CVE: CVE-2026-50221
Title: Swift proxy-server SSRF via header injection
Affects: Swift >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2
Description: Tim Shephard from roiai.ca reported a server-side request forgery (SSRF) vulnerability in Swift's proxy-server. An authenticated user can cause Swift object servers to issue outbound HTTP requests to attacker-specified hosts, potentially exposing internal infrastructure details. All deployments running Swift 2.0.0 or later are affected.
Patches: 2026.2/hibiscus (development): https://review.opendev.org/994449 2026.1/gazpacho: https://review.opendev.org/994450 2025.2/flamingo: https://review.opendev.org/994451 2025.1/epoxy: https://review.opendev.org/994452
Credits: Tim Shephard from roiai.ca (CVE-2026-50221)
References: https://security.openstack.org/ossa/OSSA-2026-024.html https://launchpad.net/bugs/2150261 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50221
Regards, Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
====================================================================================== ======================================================================================
:Date: May 27, 2026 :CVE: CVE-2026-49017
Affects ~~~~~~~ - Swift: >=2.35.1 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2
Description ~~~~~~~~~~~ Errata ~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/990355 (2025.1/epoxy) - https://review.opendev.org/990262 (2025.2/flamingo) - https://review.opendev.org/990261 (2026.1/gazpacho) - https://review.opendev.org/987957 (2026.2/hibiscus)
Credits ~~~~~~~ - Alistair Coles from NVIDIA (CVE-2026-49017)
References ~~~~~~~~~~ - https://launchpad.net/bugs/2152205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49017
OSSA History ~~~~~~~~~~~~ - 2026-05-29 - Errata 1 - 2026-05-27 - Original Version
-- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
====================================================================================== ======================================================================================
:Date: May 27, 2026 :CVE: CVE-2026-49017
Affects ~~~~~~~ - Swift: >=2.36.0 <2.36.2, >=2.37.0 <2.37.2
Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/990262 (2025.2/flamingo) - https://review.opendev.org/990261 (2026.1/gazpacho) - https://review.opendev.org/987957 (2026.2/hibiscus)
Credits ~~~~~~~ - Alistair Coles from NVIDIA (CVE-2026-49017)
References ~~~~~~~~~~ - https://launchpad.net/bugs/2152205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49017
-- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
OpenStack Object Storage (Swift) before 2.3.0, when allowversion is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.