Swift
Monthly
Untrusted-link activation inside an Ionic Capacitor app on Android or iOS can render attacker-controlled HTML at the application's own origin via the internal /_capacitor_http_interceptor_ proxy path, giving that script full same-origin access to storage, cookies and registered Capacitor plugin capabilities. Affected releases are 6.0.0 up to (but not including) 6.2.2, 7.6.9, 8.3.5, 8.4.3 and 8.5.1; exploitation requires the victim to activate an attacker-supplied link in the WebView (UI:R) but no authentication (PR:N) and no non-default feature flag, so apps are exposed even when the CapacitorHttp plugin is disabled because vulnerable builds serve the proxy path regardless of that setting. No public exploit code or confirmed active exploitation was identified at time of analysis, though the high CVSS score of 9.3 (S:C/C:H/I:H) and the broad mobile install base make patch urgency high.
Denial of service in Wire's Swift runtime (the SPM/CocoaPods 'Wire' product, implemented by wire-runtime-swift) lets an unauthenticated remote attacker abort a decoding process with a single 10-byte protobuf payload; all released Swift runtime versions through 6.4.0 and Wire 7 alphas through 7.0.0-alpha03 are affected. An unknown START_GROUP field wrapping a LENGTH_DELIMITED field whose varint decodes to a negative Int32 (for example -128) slips past a bounds check in ReadBuffer.readData(count:) that only validates the upper bound, and the negative count reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing the documented, catchable ProtoDecoder.Error. Publicly available exploit code exists (the vendor advisory ships a complete proof of concept), but there is no indication of active exploitation; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) reflects a low-complexity remote availability impact confined to Swift applications that actually feed untrusted protobuf bytes to Wire's decoder.
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exhaust all proxy worker threads with a trivially crafted HTTP Accept header. The proxy server's Accept header parser employs a qdtext regex pattern susceptible to catastrophic backtracking (CWE-1333), where a payload of just 32 backslash-character pairs stalls a single worker for over 30 seconds. Repeated concurrent requests consume all available proxy workers, causing complete and sustained service unavailability — no authentication, session, or account is required. No public exploit or CISA KEV listing has been identified at time of analysis, though the description itself constitutes a functional attack recipe.
Denial of service in OpenStack Swift's s3api middleware allows an authenticated S3 API user to permanently hang proxy-server workers by sending a truncated aws-chunked PUT request body. Versions 2.36.0 through 2.36.1 and 2.37.0 through 2.37.1 are affected; the defect was introduced in 2.36.0 and fixed in 2.36.2 and 2.37.2. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), but the high availability impact and low attack complexity make this a credible operational threat to S3-compatible Swift deployments.
Information disclosure in OpenStack Swift deployments that run the shipped default proxy pipeline: the tempurl middleware does not reject an attacker-supplied X-Copy-From header on signed PUT requests, so anyone holding a valid, unexpired PUT TempURL for a single object can make the copy middleware pull another object from the same account into the destination path and then read that data back using a GET TempURL for the destination. The impact is bounded rather than systemic - copies across account boundaries are rejected, deployments without the copy middleware in the pipeline are unaffected, and the CVSS score is 5.3 with a PR:L vector reflecting the need to hold a legitimate signed TempURL capability. No public exploit code has been identified at time of analysis, and CVE-2026-97149 is not reported as confirmed actively exploited (CISA KEV).
Cross-tenant object exfiltration in OpenStack Swift through 2.38.0 allows authenticated S3 API users to bypass source-object authorization by injecting Swift-native server-side copy headers (X-Copy-From, X-Copy-From-Account) into a signed S3 PUT request. The S3API middleware authorizes the request against the attacker-controlled destination bucket and then forwards the copy headers to Swift's copy engine, which executes the cross-tenant copy without re-evaluating the source object's ACLs or ownership - a classic confused-deputy flaw (CWE-863). Exploitation is constrained to deployments with the non-default s3_acl=true option enabled, and no public exploit is identified at time of analysis.
OpenStack Swift's S3API middleware through version 2.38.0 fails to enforce SigV4 signature coverage over semantic x-amz-* headers on presigned URL requests, enabling unauthorized server-side object copy operations under the signer's authorization context. An attacker holding a valid presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, redirecting Swift's behavior from a client upload into a server-side copy that reads any object accessible to the URL's original signer - effectively allowing privilege escalation within a delegated authorization context. No public exploit or CISA KEV listing was identified at time of analysis, but all deployments running the S3API middleware under the default s3_acl=false configuration are affected.
Server-side request forgery in OpenStack Swift's proxy-server allows authenticated users to manipulate object servers into issuing outbound HTTP requests to attacker-specified hosts. All Swift deployments running version 2.0.0 or later across all maintained release trains are affected, including the 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and development 2026.2/hibiscus branches. No public exploit has been identified at time of analysis, but successful exploitation could expose internal infrastructure topology, metadata services, or other resources reachable from the object server tier.
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stack overflow issue existed in Swift for Linux. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable.
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Untrusted-link activation inside an Ionic Capacitor app on Android or iOS can render attacker-controlled HTML at the application's own origin via the internal /_capacitor_http_interceptor_ proxy path, giving that script full same-origin access to storage, cookies and registered Capacitor plugin capabilities. Affected releases are 6.0.0 up to (but not including) 6.2.2, 7.6.9, 8.3.5, 8.4.3 and 8.5.1; exploitation requires the victim to activate an attacker-supplied link in the WebView (UI:R) but no authentication (PR:N) and no non-default feature flag, so apps are exposed even when the CapacitorHttp plugin is disabled because vulnerable builds serve the proxy path regardless of that setting. No public exploit code or confirmed active exploitation was identified at time of analysis, though the high CVSS score of 9.3 (S:C/C:H/I:H) and the broad mobile install base make patch urgency high.
Denial of service in Wire's Swift runtime (the SPM/CocoaPods 'Wire' product, implemented by wire-runtime-swift) lets an unauthenticated remote attacker abort a decoding process with a single 10-byte protobuf payload; all released Swift runtime versions through 6.4.0 and Wire 7 alphas through 7.0.0-alpha03 are affected. An unknown START_GROUP field wrapping a LENGTH_DELIMITED field whose varint decodes to a negative Int32 (for example -128) slips past a bounds check in ReadBuffer.readData(count:) that only validates the upper bound, and the negative count reaches Foundation's Data(bytes:count:), which traps with SIGTRAP instead of throwing the documented, catchable ProtoDecoder.Error. Publicly available exploit code exists (the vendor advisory ships a complete proof of concept), but there is no indication of active exploitation; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) reflects a low-complexity remote availability impact confined to Swift applications that actually feed untrusted protobuf bytes to Wire's decoder.
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exhaust all proxy worker threads with a trivially crafted HTTP Accept header. The proxy server's Accept header parser employs a qdtext regex pattern susceptible to catastrophic backtracking (CWE-1333), where a payload of just 32 backslash-character pairs stalls a single worker for over 30 seconds. Repeated concurrent requests consume all available proxy workers, causing complete and sustained service unavailability — no authentication, session, or account is required. No public exploit or CISA KEV listing has been identified at time of analysis, though the description itself constitutes a functional attack recipe.
Denial of service in OpenStack Swift's s3api middleware allows an authenticated S3 API user to permanently hang proxy-server workers by sending a truncated aws-chunked PUT request body. Versions 2.36.0 through 2.36.1 and 2.37.0 through 2.37.1 are affected; the defect was introduced in 2.36.0 and fixed in 2.36.2 and 2.37.2. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), but the high availability impact and low attack complexity make this a credible operational threat to S3-compatible Swift deployments.
Information disclosure in OpenStack Swift deployments that run the shipped default proxy pipeline: the tempurl middleware does not reject an attacker-supplied X-Copy-From header on signed PUT requests, so anyone holding a valid, unexpired PUT TempURL for a single object can make the copy middleware pull another object from the same account into the destination path and then read that data back using a GET TempURL for the destination. The impact is bounded rather than systemic - copies across account boundaries are rejected, deployments without the copy middleware in the pipeline are unaffected, and the CVSS score is 5.3 with a PR:L vector reflecting the need to hold a legitimate signed TempURL capability. No public exploit code has been identified at time of analysis, and CVE-2026-97149 is not reported as confirmed actively exploited (CISA KEV).
Cross-tenant object exfiltration in OpenStack Swift through 2.38.0 allows authenticated S3 API users to bypass source-object authorization by injecting Swift-native server-side copy headers (X-Copy-From, X-Copy-From-Account) into a signed S3 PUT request. The S3API middleware authorizes the request against the attacker-controlled destination bucket and then forwards the copy headers to Swift's copy engine, which executes the cross-tenant copy without re-evaluating the source object's ACLs or ownership - a classic confused-deputy flaw (CWE-863). Exploitation is constrained to deployments with the non-default s3_acl=true option enabled, and no public exploit is identified at time of analysis.
OpenStack Swift's S3API middleware through version 2.38.0 fails to enforce SigV4 signature coverage over semantic x-amz-* headers on presigned URL requests, enabling unauthorized server-side object copy operations under the signer's authorization context. An attacker holding a valid presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, redirecting Swift's behavior from a client upload into a server-side copy that reads any object accessible to the URL's original signer - effectively allowing privilege escalation within a delegated authorization context. No public exploit or CISA KEV listing was identified at time of analysis, but all deployments running the S3API middleware under the default s3_acl=false configuration are affected.
Server-side request forgery in OpenStack Swift's proxy-server allows authenticated users to manipulate object servers into issuing outbound HTTP requests to attacker-specified hosts. All Swift deployments running version 2.0.0 or later across all maintained release trains are affected, including the 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and development 2026.2/hibiscus branches. No public exploit has been identified at time of analysis, but successful exploitation could expose internal infrastructure topology, metadata services, or other resources reachable from the object server tier.
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stack overflow issue existed in Swift for Linux. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity.
OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which exceed the limit when. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable.
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.