Read the docs
TI-2026-36265 Aliases CVE-2026-49017GHSA-g7jq-j257-rww2

Infinite loop in OpenStack Swift

Priority LOW 31CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Fix Partial Swift (OpenStack): 2.36.2, 2.37.2, 2.35.3Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenStackSwift2.36.0 to before 2.36.2; 2.37.0 to before 2.37.2; 2.35.1 to before 2.35.32.36.2, 2.37.2, 2.35.3Patch availableCNA
—swift (PyPI)2.36.0 – 2.36.1—No fix listedGHSA-g7jq-j257-rww2
—swift (PyPI)2.37.0 – 2.37.1—No fix listedGHSA-g7jq-j257-rww2
  • Swift VendorOpenStack Affected 2.36.0 to before 2.36.2; 2.37.0 to before 2.37.2; 2.35.1 to before 2.35.3 Fixed in 2.36.2, 2.37.2, 2.35.3 Patch available CNA
  • swift (PyPI) Vendor— Affected 2.36.0 – 2.36.1 Fixed in — No fix listed GHSA-g7jq-j257-rww2
  • swift (PyPI) Vendor— Affected 2.37.0 – 2.37.1 Fixed in — No fix listed GHSA-g7jq-j257-rww2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*2.35.1 to before 2.35.3; 2.36.0 to before 2.36.2; 2.37.0 to before 2.37.2VulnerableOpenStack
  • cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:* Versions 2.35.1 to before 2.35.3; 2.36.0 to before 2.36.2; 2.37.0 to before 2.37.2 Vulnerable ·OpenStack

Remediation

  • Fix · CNA Swift (OpenStack) Fixed in 2.36.2, 2.37.2, 2.35.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49017
  2. 2026-10-03 Alias added: GHSA-g7jq-j257-rww2

References

Patch 4

Advisory 2

Other 1

  • TI-2017-12224 An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with… CVSS 3.0CRITICAL 9.8
  • TI-2012-03749 OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle… CVSS 3.1CRITICAL 9.8
  • TI-2016-00662 OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1… CVSS 3.0HIGH 7.5
  • TI-2016-00661 OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections… CVSS 3.0HIGH 7.5
  • TI-2015-01667 OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows… CVSS 2.0MEDIUM 5.5
  • TI-2022-23761 An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and… CVSS 3.1MEDIUM 6.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences