EUVD-2026-53048
GHSA-4jj7-q8c5-78g4
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exhaust all proxy worker threads with a trivially crafted HTTP Accept header. The proxy server's Accept header parser employs a qdtext regex pattern susceptible to catastrophic backtracking (CWE-1333), where a payload of just 32 backslash-character pairs stalls a single worker for over 30 seconds. Repeated concurrent requests consume all available proxy workers, causing complete and sustained service unavailability — no authentication, session, or account is required. No public exploit or CISA KEV listing has been identified at time of analysis, though the description itself constitutes a functional attack recipe.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Openstack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.
Executive ViewAI
OpenStack Swift proxy servers versions 2.38.0 and earlier are vulnerable to remote unauthenticated denial of service through a malformed HTTP Accept header that triggers catastrophic regex backtracking, rendering affected deployment completely unavailable. Any network-accessible Swift installation lacks protection against this attack, which requires only a 32-character payload and no credentials. This vulnerability directly impacts organizations relying on Swift for cloud storage and data access continuity.
Within 24 hours: inventory all OpenStack Swift proxy deployments and confirm versions at or below 2.38.0; implement immediate network-layer filtering or WAF rules to block requests with malformed or excessive backslash sequences in Accept headers. Within 7 days: deploy application-level rate limiting on proxy Accept header parsing and configure a reverse proxy (nginx/HAProxy) with strict HTTP header validation in front of Swift; establish monitoring for abnormal proxy worker thread utilization. Within 30 days: subscribe to OpenStack security advisories, establish a maintenance window for immediate patch deployment upon vendor release, and conduct a full security assessment of your Swift infrastructure for similar ReDoS vulnerabilities in other header parsers.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) implement rate limiting to restrict Accept header parsing requests per IP; (2) configure WAF to reject headers containing backslash sequences or non-standard Accept values; (3) deploy reverse proxy with strict HTTP compliance checking; (4) restrict proxy access via network segmentation to trusted networks only; (5) establish real-time alerting on proxy worker thread utilization to detect attacks; (6) maintain isolated capacity for administrative access to Swift in event of widespread DoS.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an int
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Code injection in OpenStack Vitrage query parser allows authenticated users to execute arbitrary Python code through cra
Exploit-DB