CVE-2026-71190

Deploy a reverse proxy (such as HAProxy, nginx, or Apache httpd) in front of the Swift proxy server and configure it to limit the size of the Accept request header. A limit of 256 bytes is sufficient for all legitimate Accept header values used by Swift clients. For example, in HAProxy: use 'http-request deny if { req.hdr(accept) -m len gt 256 }'. In nginx: use 'large_client_header_buffers' to restrict header size. Alternatively, a WAF rule can be deployed to reject Accept headers containing backslash characters in quoted strings without a closing quote, though the header size limit is simpler and more robust. Note that Swift's built-in max_header_size (default 8192 bytes) does NOT mitigate this vulnerability because the exponential backtracking is triggered with as few as 27 backslash-character pairs (~54 bytes).

In Red Hat OpenStack Services on OpenShift (RHOSO) environments, the Swift API is deployed behind an OpenShift-managed HAProxy load balancer. The available OCP route annotations do not support custom header inspection rules such as 'http-request deny if', making the header size limit approach not feasible. Rate limiting via route annotations (e.g., rate-limit-connections.rate-http) provides only partial protection, as a single crafted request can still lock a proxy worker for minutes, and attackers using multiple source IPs can bypass per-IP limits. Additionally, default rate limits cannot be shipped as a mitigation because they would break deployer configurations. For RHOSO deployments, applying the upstream patch backport is the only effective remediation.