Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-28T15:00:00 openstack-swift: openstack-swift: Unauthenticated denial of service via catastrophic backtracking in Accept header parser 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1333

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causing a proxy worker to consume 100% CPU for an extended period. Because the regex evaluation runs at the C level, client disconnection does not interrupt the computation. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service for the Swift object storage cluster.

Red Hat OpenStack Platform (RHOSP) and Red Hat OpenStack Services on OpenShift (RHOSO) ship OpenStack Swift as the openstack-swift package. Deployments using the default proxy-server pipeline configuration are affected because the listing_formats middleware processes Accept headers before authentication. The vulnerability is accessible without authentication on account and container listing endpoints (GET/HEAD requests). In RHOSP deployments, operators who manage their own load balancer (HAProxy, nginx) can apply the header size limit mitigation described above as a temporary measure until the fix is backported. In RHOSO deployments, the Swift API sits behind an OpenShift-managed HAProxy with configuration limited to OCP route annotations, which do not support the header inspection rules needed for effective mitigation. For RHOSO, backporting the upstream fix is the only effective remediation. Upstream acknowledges Christian Schwede (NVIDIA) as the original reporter. Deploy a reverse proxy (such as HAProxy, nginx, or Apache httpd) in front of the Swift proxy server and configure it to limit the size of the Accept request header. A limit of 256 bytes is sufficient for all legitimate Accept header values used by Swift clients. For example, in HAProxy: use 'http-request deny if { req.hdr(accept) -m len gt 256 }'. In nginx: use 'large_client_header_buffers' to restrict header size. Alternatively, a WAF rule can be deployed to reject Accept headers containing backslash characters in quoted strings without a closing quote, though the header size limit is simpler and more robust. Note that Swift's built-in max_header_size (default 8192 bytes) does NOT mitigate this vulnerability because the exponential backtracking is triggered with as few as 27 backslash-character pairs (~54 bytes). In Red Hat OpenStack Services on OpenShift (RHOSO) environments, the Swift API is deployed behind an OpenShift-managed HAProxy load balancer. The available OCP route annotations do not support custom header inspection rules such as 'http-request deny if', making the header size limit approach not feasible. Rate limiting via route annotations (e.g., rate-limit-connections.rate-http) provides only partial protection, as a single crafted request can still lock a proxy worker for minutes, and attackers using multiple source IPs can bypass per-IP limits. Additionally, default rate limits cannot be shipped as a mitigation because they would break deployer configurations. For RHOSO deployments, applying the upstream patch backport is the only effective remediation. Red Hat OpenStack Platform 13 (Queens) Will not fix rhosp13/openstack-swift-account Red Hat OpenStack Platform 13 (Queens) Will not fix rhosp13/openstack-swift-base Red Hat OpenStack Platform 13 (Queens) Will not fix rhosp13/openstack-swift-container Red Hat OpenStack Platform 13 (Queens) Will not fix rhosp13/openstack-swift-object Red Hat OpenStack Platform 13 (Queens) Will not fix rhosp13/openstack-swift-proxy-server Red Hat OpenStack Platform 16.2 Affected openstack-swift Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-swift-account Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-swift-base Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-swift-container Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-swift-object Red Hat OpenStack Platform 16.2 Affected rhosp-rhel8/openstack-swift-proxy-server Red Hat OpenStack Platform 17.1 Affected openstack-swift Red Hat OpenStack Platform 17.1 Affected rhosp-rhel9/openstack-swift-account Red Hat OpenStack Platform 17.1 Affected rhosp-rhel9/openstack-swift-base Red Hat OpenStack Platform 17.1 Affected rhosp-rhel9/openstack-swift-container Red Hat OpenStack Platform 17.1 Affected rhosp-rhel9/openstack-swift-object Red Hat OpenStack Platform 17.1 Affected rhosp-rhel9/openstack-swift-proxy-server Red Hat OpenStack Platform 18.0 Affected openstack-swift Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-swift-account-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-swift-base-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-swift-container-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-swift-object-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso/openstack-swift-proxy-server-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71190 https://nvd.nist.gov/vuln/detail/CVE-2026-71190 https://launchpad.net/bugs/2158771