OpenStack Swift 2.38.0 ReDoS in Proxy Accept Header Parser (CVE-2026-71190)
CVE-2026-71190 Published on August 5, 2026
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
Vulnerability Analysis
CVE-2026-71190 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a ReDoS Vulnerability?
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:
CVE-2026-71190 has been classified to as a ReDoS vulnerability or weakness.
Products Associated with CVE-2026-71190
Want to know whenever a new CVE is published for OpenStack Swift? stack.watch will email you.
Affected Versions
OpenStack Swift:- Version 1.9.1 and below 2.35.4 is affected.
- Version 2.36.0 and below 2.36.3 is affected.
- Version 2.37.0 and below 2.37.3 is affected.
- Version 2.38.0 is affected.