CVE-2026-71190: Openstack Swift

High severity, CVSS 8.7. EPSS: 0.8% chance of exploitation in the next 30 days.

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

Affected products

• Openstack Swift: from 1.9.1, before 2.35.4 (fixed in 2.35.4); from 2.36.0, before 2.36.3 (fixed in 2.36.3); from 2.37.0, before 2.37.3 (fixed in 2.37.3); version 2.38.0 only

Published 2026-08-05. Last modified 2026-09-09.