Skip to content
OpenAdvisories
High · 7.1 CVE-2026-49017 EUVD-2026-32040GHSA-g7jq-j257-rww2PYSEC-2026-3080

OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body

Published May 27, 2026 · Updated Jun 2, 2026 · Assigned by mitre

Description

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

Affected products

VendorProductAffectedFixed
OpenStack Swift 2.36.0 – < 2.36.2, 2.37.0 – < 2.37.2, 2.35.1 – < 2.35.3 2.36.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 swift 2.37.1-4 —
Debian 13 swift 2.35.1-0+deb13u2 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS swift 2.37.1-0ubuntu2.1 USN-8821-1
Ubuntu 25.10 swift No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI swift >= 2.36.0, <= 2.36.1 — GHSA-g7jq-j257-rww2
PyPI swift >= 2.37.0, <= 2.37.1 — GHSA-g7jq-j257-rww2
PyPI swift >= 2.36.0, <= 2.36.1 · >= 2.37.0, <= 2.37.1 — PYSEC-2026-3080

Advisories 1

References