CVE-2026-71190 in Swift
Summary
by MITRE • 08/05/2026
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within OpenStack Swift's proxy server component where the Accept header parser utilizes a regular expression susceptible to catastrophic backtracking or regex denial of service. This flaw resides in the qdtext pattern which is defined as (?:[^"]|\\.)* and processes incoming HTTP Accept headers without proper validation. The implementation follows a classic ReDoS attack vector where malicious input causes the regular expression engine to perform exponential time complexity operations. The vulnerability demonstrates a clear weakness in input sanitization and regex design practices that aligns with CWE-1321, specifically targeting regular expression vulnerabilities that lead to resource exhaustion.
The technical exploitation occurs when an unauthenticated remote attacker crafts a specially formatted Accept header containing multiple backslash-character pairs that trigger the vulnerable regex pattern. Each additional pair of backslashes in the payload exponentially increases the computational complexity required for the regular expression engine to process the input. With just 32 backslash-character pairs, the processing time escalates beyond 30 seconds of CPU consumption, demonstrating the severe performance impact that can be achieved through this methodical approach. The vulnerability operates at the HTTP layer where the proxy server worker processes these requests, making it a direct attack surface for service disruption.
The operational impact of this vulnerability extends far beyond simple resource exhaustion, as repeated exploitation attempts can completely overwhelm the proxy worker threads and render the entire OpenStack Swift service unavailable. This creates a complete denial of service condition that affects all users of the system without requiring any authentication credentials or privileged access. The attack can be executed at scale through automated tools, making it particularly dangerous for production environments where service availability is critical. This represents a significant security concern within cloud infrastructure platforms where such vulnerabilities can be leveraged to disrupt business operations and compromise availability.
Organizations should implement immediate mitigations including input validation controls that limit the size and complexity of Accept headers, regular expression engine configuration changes to prevent catastrophic backtracking scenarios, and rate limiting mechanisms to reduce the impact of repeated attack attempts. The implementation should follow security best practices outlined in the ATT&CK framework for defense against resource exhaustion attacks and consider using alternative parsing methods that are not susceptible to regex-based exploits. Additionally, deployment configurations should include monitoring for unusual CPU consumption patterns and automated alerting systems to detect potential exploitation attempts.