Denial of Service Vulnerability in OpenStack Swift by OpenStack

CVE-2026-49017

What is CVE-2026-49017?

In certain versions of OpenStack Swift, a vulnerability exists in the s3api middleware that can lead to a denial of service. When processing a truncated aws-chunked PUT request body, the middleware enters an infinite loop. This results in the StreamingInput class repeatedly appending an empty buffer. Consequently, the proxy-server worker becomes unresponsive as CPU and memory consumption escalate. An authenticated attacker could exploit this flaw to exhaust all proxy-server workers systematically, leading to service disruption. This defect originated in version 2.36.0 of OpenStack Swift and was addressed in later releases.

References