{"id":"CVE-2026-49017","aliases":["DEBIAN-CVE-2026-49017","EUVD-2026-32040","GHSA-g7jq-j257-rww2","PYSEC-2026-3080","UBUNTU-CVE-2026-49017","USN-8821-1"],"status":"published","title":"OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00358,"percentile":0.29779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-05-27T01:57:58Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Debian:13","package":"swift","fixed_in":["2.35.1-0+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"swift","fixed_in":["2.37.1-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"swift","fixed_in":["2.37.1-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.36.0"},{"last_affected":"2.36.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"last_affected":"2.37.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35.1-0+deb13u2"}]}],"versions":["2.35.0-4","2.35.1-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.1-4"}]}],"versions":["2.35.0-4","2.35.1-1","2.35.1-2","2.36.0-1","2.36.0-2","2.36.0-3","2.36.0-4","2.36.0-5","2.36.0-6","2.36.0-7","2.36.0-8","2.37.0-1","2.37.1-1","2.37.1-2","2.37.1-3"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.36.0"},{"last_affected":"2.36.1"}]}],"versions":["2.36.0","2.36.1"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0"},{"last_affected":"2.37.1"}]}],"versions":["2.37.0","2.37.1"]},{"source":"osv","ecosystem":"PyPI","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.36.0"},{"last_affected":"2.36.1"},{"introduced":"2.37.0"},{"last_affected":"2.37.1"}]}],"versions":["2.36.0","2.36.1","2.37.0","2.37.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.35.0-0ubuntu1","2.35.0+git2025070714.1428eb3b5-0ubuntu1","2.36.0-0ubuntu1","2.36.0-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.1-0ubuntu2.1"}]}],"versions":["2.36.0-0ubuntu1","2.37.0-0ubuntu1","2.37.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.1-0ubuntu2.1"}]}],"versions":["2.36.0-0ubuntu1","2.37.0-0ubuntu1","2.37.1-0ubuntu2"]}],"products":[{"vendor":"openstack","product":"swift"}],"references":[{"url":"https://bugs.launchpad.net/bugs/2152205","tags":["issue-tracking","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://review.opendev.org/c/openstack/swift/+/987957","tags":["patch","Issue Tracking","Patch","fix","web","report"]},{"url":"https://review.opendev.org/c/openstack/swift/+/988093","tags":["technical-description","Issue Tracking","Patch","article","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/27/9","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/02/6","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49017","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g7jq-j257-rww2","tags":["advisory"]},{"url":"https://opendev.org/openstack/swift","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49017.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49017","tags":["advisory"]},{"url":"https://github.com/openstack/swift","tags":["package"]},{"url":"https://pypi.org/project/swift","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-49017","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49017","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8821-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-49017","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T01:57:58.831Z","modified":"2026-06-02T17:33:08.62Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-32040","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T01:57:58Z","modified":"2026-06-02T17:33:08Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"updated_at":"2026-11-02T18:20:55.651138Z"}],"ghsa":[{"id":"GHSA-g7jq-j257-rww2","title":"OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T03:30:31Z","modified":"2026-07-01T18:04:12Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:40:36.577366Z"}],"nvd":[{"id":"CVE-2026-49017","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T02:16:34.327Z","modified":"2026-09-24T17:25:35.187Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:20.511562Z"}],"osv":[{"id":"CVE-2026-49017","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T01:57:58.831Z","modified":"2026-10-28T02:30:25.344040667Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-49017","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T02:16:34.327Z","modified":"2026-09-25T09:00:10.03626387Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-g7jq-j257-rww2","title":"OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T03:30:31Z","modified":"2026-07-13T16:43:07.382949863Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"PYSEC-2026-3080","title":"OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-07-13T15:19:12.337104Z","modified":"2026-07-13T16:33:13.255199366Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"UBUNTU-CVE-2026-49017","description":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.","status":"published","published":"2026-05-27T02:16:00Z","modified":"2026-09-25T17:45:09.216753301Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"USN-8821-1","title":"swift vulnerability","description":"It was discovered that OpenStack Swift incorrectly handled truncated\naws-chunked PUT request bodies in its s3api middleware. An authenticated\nattacker could possibly use this issue to cause OpenStack Swift to use\nexcessive resources, leading to a denial of service.","status":"published","published":"2026-09-24T19:18:41Z","modified":"2026-09-25T17:45:10.111608768Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}