Where
-Infinity
0

Trending

Last week
Last month
Last year

pip/swiftCode Injection

Risk 89
Severity
9.8
Code Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.

1 / 2
Source: GitHub
First published (updated )
CVE-2012-4406

Openstack SwiftThe OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify…

Risk 69
Severity
9.1
AV:N/AC:M/Au:N/C:P/I:P/A:N

The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

1 / 2
Source: MITRE
First published (updated )
CVE-2013-6396

Openstack Swift[OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-71190)

Risk 50
Severity
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.) allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

First published (updated )
CVE-2026-71190

pip/swiftInfoleak

Risk 45
Severity
7.5
Infoleak
AV:N/AC:M/Au:N/C:P/I:N/A:N

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.

First published (updated )
CVE-2014-0006

Fedoraproject FedoraInput Validation

Risk 56
Severity
7.4
Input Validation
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.

First published (updated )
CVE-2015-8466

Openstack Swift[OSSA-2026-014] OpenStack Swift: Swift proxy-server denial of service via truncated s3api chunked upload (CVE-2026-49017)

Risk 43
Severity
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

First published (updated )
CVE-2026-49017

Openstack puppet-swiftInfoleak

Risk 36
Severity
6.5
Infoleak
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation of Object Storage (swift). During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions.

First published (updated )
CVE-2016-9590

Openstack Swift[OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-71191, CVE-2026-71192)

Risk 37
Severity
6
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy from an arbitrary source object using the signer's authorization context. The attacker can read any object the signer has access to, provided the target projectid, container name, and object name are known. This affects all deployments using the default s3acl=false configuration.

First published (updated )
CVE-2026-71191

pip/swiftOpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authe…

Risk 35
Severity
5.5
AV:N/AC:L/Au:S/C:N/I:P/A:P

OpenStack Object Storage (Swift) before 2.3.0, when allowversion is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.

First published (updated )
CVE-2015-1856

Openstack Swift[OSSA-2026-024] OpenStack Swift: Swift proxy-server SSRF via header injection (CVE-2026-50221)

Risk 36
Severity
5.3
SSRF
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism.

First published (updated )
CVE-2026-50221

pip/swiftBuffer Overflow

Risk 22
Severity
4
Buffer Overflow
AV:N/AC:L/Au:S/C:N/I:N/A:P

OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.

First published (updated )
CVE-2013-4155

oss-sec[OSSA-2026-014] OpenStack Swift: Swift proxy-server denial of service via truncated s3api chunked upload (CVE-2026-49017)

====================================================================================== ======================================================================================

:Date: May 27, 2026 :CVE: CVE-2026-49017

Affects ~~~~~~~ - Swift: >=2.36.0 <2.36.2, >=2.37.0 <2.37.2

Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/990262 (2025.2/flamingo) - https://review.opendev.org/990261 (2026.1/gazpacho) - https://review.opendev.org/987957 (2026.2/hibiscus)

Credits ~~~~~~~ - Alistair Coles from NVIDIA (CVE-2026-49017)

References ~~~~~~~~~~ - https://launchpad.net/bugs/2152205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49017

-- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q2/714

oss-sec[OSSA-2026-014] OpenStack Swift: Errata 1 - Proxy-server denial of service via truncated s3api chunked upload, (CVE-2026-49017)

====================================================================================== ======================================================================================

:Date: May 27, 2026 :CVE: CVE-2026-49017

Affects ~~~~~~~ - Swift: >=2.35.1 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2

Description ~~~~~~~~~~~ Errata ~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/990355 (2025.1/epoxy) - https://review.opendev.org/990262 (2025.2/flamingo) - https://review.opendev.org/990261 (2026.1/gazpacho) - https://review.opendev.org/987957 (2026.2/hibiscus)

Credits ~~~~~~~ - Alistair Coles from NVIDIA (CVE-2026-49017)

References ~~~~~~~~~~ - https://launchpad.net/bugs/2152205 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49017

OSSA History ~~~~~~~~~~~~ - 2026-05-29 - Errata 1 - 2026-05-27 - Original Version

-- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q2/780

oss-sec[OSSA-2026-024] OpenStack Swift: Swift proxy-server SSRF via header injection (CVE-2026-50221)

OpenStack Security Advisory: OSSA-2026-024 CVE: CVE-2026-50221

Title: Swift proxy-server SSRF via header injection

Affects: Swift >=2.0.0 <2.35.3, >=2.36.0 <2.36.2, >=2.37.0 <2.37.2

Description: Tim Shephard from roiai.ca reported a server-side request forgery (SSRF) vulnerability in Swift's proxy-server. An authenticated user can cause Swift object servers to issue outbound HTTP requests to attacker-specified hosts, potentially exposing internal infrastructure details. All deployments running Swift 2.0.0 or later are affected.

Patches: 2026.2/hibiscus (development): https://review.opendev.org/994449 2026.1/gazpacho: https://review.opendev.org/994450 2025.2/flamingo: https://review.opendev.org/994451 2025.1/epoxy: https://review.opendev.org/994452

Credits: Tim Shephard from roiai.ca (CVE-2026-50221)

References: https://security.openstack.org/ossa/OSSA-2026-024.html https://launchpad.net/bugs/2150261 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50221

Regards, Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q2/1005

oss-sec[OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-pending)

====================================================== OSSA-2026-030: Swift S3API header authorization bypass ======================================================

:Date: July 28, 2026 :CVE: CVE-2026-pending, CVE-2026-pending

Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development))

Credits ~~~~~~~ - Christian Schwede from NVIDIA

References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q3/314

oss-sec[OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-pending)

============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ==============================================================

:Date: July 28, 2026 :CVE: CVE-2026-pending

Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development))

Credits ~~~~~~~ - Christian Schwede from NVIDIA

References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q3/315

oss-sec[OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-71191, CVE-2026-71192)

====================================================== OSSA-2026-030: Swift S3API header authorization bypass ======================================================

:Date: July 28, 2026 :CVE: CVE-2026-71191, CVE-2026-71192

Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description ~~~~~~~~~~~ Errata ~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development))

Credits ~~~~~~~ - Christian Schwede from NVIDIA

References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71191 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71192

OSSA History ~~~~~~~~~~~~ - 2026-08-05 - Errata 1 - 2026-07-28 - Original Version

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

On 7/28/26 8:27 AM, Goutham Pacha Ravi wrote: ====================================================== OSSA-2026-030: Swift S3API header authorization bypass ======================================================

:Date: July 28, 2026 :CVE: CVE-2026-pending,       CVE-2026-pending

Affects ~~~~~~~ - Swift: >=2.18.0 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998948 (2025.1/epoxy) - https://review.opendev.org/998949 (2025.1/epoxy) - https://review.opendev.org/998946 (2025.2/flamingo) - https://review.opendev.org/998947 (2025.2/flamingo) - https://review.opendev.org/998944 (2026.1/gazpacho) - https://review.opendev.org/998945 (2026.1/gazpacho) - https://review.opendev.org/998942 (2026.2/hibiscus (development)) - https://review.opendev.org/998943 (2026.2/hibiscus (development))

Credits ~~~~~~~ - Christian Schwede from NVIDIA

References ~~~~~~~~~~ - https://launchpad.net/bugs/2158733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q3/453

oss-sec[OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-71190)

Errata 1 for OSSA-2026-031: CVE-2026-71190 has been assigned.

============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ==============================================================

:Date: July 28, 2026 :CVE: CVE-2026-71190

Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description ~~~~~~~~~~~ Errata ~~~~~~ CVE-2026-71190 has been assigned for this vulnerability.

Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development))

Credits ~~~~~~~ - Christian Schwede from NVIDIA

References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71190

OSSA History ~~~~~~~~~~~~ - 2026-08-05 - Errata 1 - 2026-07-28 - Original Version

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

On 7/28/26 8:28 AM, Goutham Pacha Ravi wrote: ============================================================== OSSA-2026-031: Swift proxy denial of service via Accept header ==============================================================

:Date: July 28, 2026 :CVE: CVE-2026-pending

Affects ~~~~~~~ - Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/998953 (2025.1/epoxy) - https://review.opendev.org/998952 (2025.2/flamingo) - https://review.opendev.org/998951 (2026.1/gazpacho) - https://review.opendev.org/998950 (2026.2/hibiscus (development))

Credits ~~~~~~~ - Christian Schwede from NVIDIA

References ~~~~~~~~~~ - https://launchpad.net/bugs/2158771 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending

-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

First published (updated )
https://seclists.org/oss-sec/2026/q3/454

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203