Description
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenStack | Swift | 2.36.0 – < 2.36.2, 2.37.0 – < 2.37.2, 2.35.1 – < 2.35.3 | 2.36.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | swift | 2.37.1-4 | — |
| Debian 13 | swift | 2.35.1-0+deb13u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | swift | 2.37.1-0ubuntu2.1 | USN-8821-1 |
| Ubuntu 25.10 | swift | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | swift | >= 2.36.0, <= 2.36.1 | — | GHSA-g7jq-j257-rww2 |
| PyPI | swift | >= 2.37.0, <= 2.37.1 | — | GHSA-g7jq-j257-rww2 |
| PyPI | swift | >= 2.36.0, <= 2.36.1 · >= 2.37.0, <= 2.37.1 | — | PYSEC-2026-3080 |
Advisories 1
- USN-8821-1 swift vulnerability Ubuntu Security Notices (USN) · Sep 25, 2026
References
- https://bugs.launchpad.net/bugs/2152205 issue-tracking
- https://review.opendev.org/c/openstack/swift/+/987957 patch
- https://review.opendev.org/c/openstack/swift/+/988093 technical-description