CVE-2026-71190: OpenStack Swift ReDoS Vulnerability

CVE-2026-71190 Overview

CVE-2026-71190 is a Regular Expression Denial of Service (ReDoS) vulnerability in the OpenStack Swift object storage proxy server through version 2.38.0. The proxy server's Accept header parser uses a qdtext pattern (?:[^"]|\\.)* that is vulnerable to catastrophic backtracking. An unauthenticated remote attacker can send a crafted Accept header containing repeated backslash-character pairs to trigger exponential CPU consumption in the proxy worker. A payload of only 32 backslash-character pairs consumes more than 30 seconds of CPU time. Repeated requests exhaust all proxy worker threads and produce a complete denial of service. The issue is tracked as CWE-1333.

Critical Impact
Unauthenticated remote attackers can exhaust all OpenStack Swift proxy worker threads with a small number of crafted HTTP requests, resulting in complete service outage for object storage clients.

Affected Products

OpenStack Swift through version 2.38.0
Deployments exposing the Swift proxy server to untrusted network clients
OpenStack distributions bundling vulnerable Swift releases

Discovery Timeline

2026-08-05 - CVE-2026-71190 published to the National Vulnerability Database
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-71190

Vulnerability Analysis

The flaw lives in the Swift proxy server's parser for the HTTP Accept header. The parser applies a regular expression that includes the qdtext sub-pattern (?:[^"]|\\.)* to match quoted-string content. This construct combines an alternation with a repetition where both branches can match overlapping input, which is the classic precondition for catastrophic backtracking.

When the regex engine attempts to match a long sequence of backslash-character pairs against a failing anchor, it explores an exponential number of match paths. Reference researchers observed that 32 backslash-character pairs push a single worker over 30 seconds of CPU time. The Swift proxy is multi-threaded but bounded, so a handful of concurrent requests occupy every worker and stall legitimate traffic. The vulnerability aligns with CWE-1333: Inefficient Regular Expression Complexity.

Root Cause

The regular expression (?:[^"]|\\.)* allows the engine to match a single character through two alternative paths: the [^"] class or the \\. escape sequence. Any character preceded by a backslash can match either branch, producing ambiguous parse trees. When the overall match cannot succeed, the engine backtracks through every combination, producing exponential time complexity in the length of the crafted input.

Attack Vector

Exploitation requires only network reachability to the Swift proxy endpoint. The attacker issues an HTTP request with an Accept header containing many backslash-character pairs inside a quoted value. No authentication, token, or prior account is required. Because the CVSS 4.0 vector reports PR:N and UI:N, any client that can reach the proxy TCP port can trigger the condition. Repeating the request from one or more sources saturates the worker pool and denies service to legitimate tenants.

No verified public proof-of-concept code is referenced by the advisory at the time of writing. Refer to the OpenStack Security Advisory OSSA-2026-031 and the Launchpad Bug Report for authoritative technical detail.

Detection Methods for CVE-2026-71190

Indicators of Compromise

HTTP requests to the Swift proxy containing Accept headers with long runs of backslash-character pairs, for example \a\a\a\a....
Proxy worker processes showing sustained CPU saturation without corresponding request throughput.
Client-side timeouts and 5xx errors from the Swift proxy while the proxy host remains reachable.
Elevated request latency across all tenants coinciding with a small volume of anomalous requests from a single source.

Detection Strategies

Inspect proxy access logs for Accept header values exceeding a reasonable length threshold, for example 256 bytes, and flag headers containing repeated \\. sequences.
Deploy a web application firewall rule that rejects or normalizes Accept headers with more than a small number of escaped characters before they reach the Swift proxy.
Correlate per-request CPU time samples with header content to identify requests that consume disproportionate compute time.
Alert on sudden increases in the ratio of in-flight proxy workers to completed requests.

Monitoring Recommendations

Track Swift proxy worker utilization, per-request CPU time, and request queue depth as first-class SRE metrics.
Ingest proxy and load balancer logs into a centralized analytics platform and build detections for oversized or malformed Accept headers.
Monitor for repeated requests from the same source addresses targeting the Swift proxy endpoint with unusual header patterns.
Emit alerts when average Accept header length or entropy shifts significantly from an established baseline.

How to Mitigate CVE-2026-71190

Immediate Actions Required

Apply the patched Swift release referenced in OSSA-2026-031 as soon as it is available for your distribution.
Restrict network access to the Swift proxy to trusted clients and known tenant networks where operationally feasible.
Deploy a reverse proxy or WAF in front of the Swift proxy to enforce strict limits on Accept header length and structure.
Rate-limit requests from individual source addresses to reduce the effective impact of any single attacker.

Patch Information

Refer to the OpenStack Security Advisory OSSA-2026-031 for the fixed Swift release list and upgrade guidance. Additional discussion is available on the OpenWall oss-security list and the corresponding follow-up thread. The upstream tracker is the Launchpad Bug Report.

Workarounds

Terminate TLS and HTTP parsing at an upstream proxy that strips or rejects oversized Accept headers before forwarding to Swift.
Enforce request timeouts at the load balancer so that any single request cannot monopolize a Swift worker beyond a few seconds.
Reduce exposure by binding the Swift proxy to internal interfaces only and requiring authenticated access through an API gateway.
Increase proxy worker counts as a temporary buffer, while recognizing this only delays exhaustion under sustained attack.

bash

# Example NGINX front-end mitigation: cap Accept header length and
# drop requests whose Accept header contains excessive backslash escapes.
http {
    large_client_header_buffers 4 2k;

    map $http_accept $accept_is_suspicious {
        default 0;
        "~*(\\\\.){8,}" 1;
    }

    server {
        listen 443 ssl;
        server_name swift.example.com;

        if ($accept_is_suspicious) {
            return 400;
        }

        location / {
            proxy_read_timeout 5s;
            proxy_send_timeout 5s;
            proxy_pass http://swift_proxy_upstream;
        }
    }
}