p PatchFirst

CVE-2026-49017

CVE-2026-49017

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • swift

    Versions
    • ≥ 2.36.0, < 2.36.2: Affected (semver)
    • ≥ 2.37.0, < 2.37.2: Affected (semver)
    • ≥ 2.35.1, < 2.35.3: Affected (semver)

    Update to 2.35.3; Update to 2.36.2; Update to 2.37.2

  • swift Debian:13

    Versions
    • 2.35.0-4
    • 2.35.1-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.35.1-0+deb13u2

    Update to 2.35.1-0+deb13u2

  • swift Debian:14

    Versions
    • 2.35.0-4
    • 2.35.1-1
    • 2.35.1-2
    • 2.36.0-1
    • 2.36.0-2
    • 2.36.0-3
    • 2.36.0-4
    • 2.36.0-5
    • 2.36.0-6
    • 2.36.0-7
    • 2.36.0-8
    • 2.37.0-1
    • 2.37.1-1
    • 2.37.1-2
    • 2.37.1-3
    Affected ranges
    • ECOSYSTEM: < 2.37.1-4

    Update to 2.37.1-4

  • swift PyPI

    Versions
    • 2.36.0
    • 2.36.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.36.0, ≤ 2.36.1

    No fix published

  • swift PyPI

    Versions
    • 2.37.0
    • 2.37.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.37.0, ≤ 2.37.1

    No fix published

  • swift PyPI

    Versions
    • 2.36.0
    • 2.36.1
    • 2.37.0
    • 2.37.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.36.0, ≤ 2.36.1 ∪ ≥ 2.37.0, ≤ 2.37.1

    No fix published

  • swift Ubuntu:25.10

    Versions
    • 2.35.0-0ubuntu1
    • 2.35.0+git2025070714.1428eb3b5-0ubuntu1
    • 2.36.0-0ubuntu1
    • 2.36.0-0ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • swift Ubuntu:26.04:LTS

    Versions
    • 2.36.0-0ubuntu1
    • 2.37.0-0ubuntu1
    • 2.37.1-0ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.37.1-0ubuntu2.1

    Update to 2.37.1-0ubuntu2.1

Original sources

Check your server →