CVE-2026-71190

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.1

Description The proxy server Accept header parser uses a regular expression with a qdtext pattern (?:[^"|.)* that is susceptible to catastrophic backtracking, a type of Regular Expression Denial of Service (ReDoS) where certain input strings cause the engine to take an exponential amount of time to process. An unauthenticated remote attacker can send a specially crafted Accept header, such as one containing 32 backslash-character pairs, to cause excessive CPU consumption in the proxy worker. Repeated requests of this nature can exhaust all available proxy worker threads, leading to a complete denial of service.

Recommendations Update OpenStack Swift to version 2.38.1 or later.