{"id":"UBUNTU-CVE-2026-71190","details":"In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The \"qdtext\" pattern (?:[^\"]|\\\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.","modified":"2026-09-25T00:40:59.445005841Z","published":"2026-08-05T06:16:00Z","upstream":["CVE-2026-71190"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-71190"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-71190"},{"type":"REPORT","url":"https://security.openstack.org/ossa/OSSA-2026-031.html"},{"type":"REPORT","url":"https://bugs.launchpad.net/swift/+bug/2158771"},{"type":"REPORT","url":"https://launchpad.net/bugs/2158771"},{"type":"REPORT","url":"https://openwall.com/lists/oss-security/2026/07/28/27"}],"affected":[{"package":{"name":"swift","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/swift?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-0ubuntu1","2.7.0-0ubuntu2","2.7.0-0ubuntu2.1","2.7.1-0ubuntu1","2.7.1-0ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"python-swift","binary_version":"2.7.1-0ubuntu2"},{"binary_version":"2.7.1-0ubuntu2","binary_name":"swift"},{"binary_name":"swift-account","binary_version":"2.7.1-0ubuntu2"},{"binary_version":"2.7.1-0ubuntu2","binary_name":"swift-container"},{"binary_version":"2.7.1-0ubuntu2","binary_name":"swift-object"},{"binary_name":"swift-object-expirer","binary_version":"2.7.1-0ubuntu2"},{"binary_name":"swift-proxy","binary_version":"2.7.1-0ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71190.json"}},{"package":{"name":"swift","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/swift?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.15.1-0ubuntu3","2.16.0-0ubuntu1","2.16.0-0ubuntu2","2.17.0-0ubuntu1","2.17.1-0ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"python-swift","binary_version":"2.17.1-0ubuntu1"},{"binary_name":"swift","binary_version":"2.17.1-0ubuntu1"},{"binary_version":"2.17.1-0ubuntu1","binary_name":"swift-account"},{"binary_version":"2.17.1-0ubuntu1","binary_name":"swift-container"},{"binary_version":"2.17.1-0ubuntu1","binary_name":"swift-object"},{"binary_name":"swift-object-expirer","binary_version":"2.17.1-0ubuntu1"},{"binary_version":"2.17.1-0ubuntu1","binary_name":"swift-proxy"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71190.json"}},{"package":{"name":"swift","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/swift?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.23.0-0ubuntu1","2.23.1-0ubuntu1","2.24.0~git2019121715.e890b0f0f-0ubuntu1","2.24.0-0ubuntu1","2.24.1~git2020032711.712bf3c9f-0ubuntu2","2.24.1~git2020041316.a495f1e32-0ubuntu1","2.25.0-0ubuntu0.20.04.1","2.25.1-0ubuntu1","2.25.2-0ubuntu1","2.25.2-0ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-swift","binary_version":"2.25.2-0ubuntu1.1"},{"binary_name":"swift","binary_version":"2.25.2-0ubuntu1.1"},{"binary_name":"swift-account","binary_version":"2.25.2-0ubuntu1.1"},{"binary_name":"swift-container","binary_version":"2.25.2-0ubuntu1.1"},{"binary_name":"swift-object","binary_version":"2.25.2-0ubuntu1.1"},{"binary_version":"2.25.2-0ubuntu1.1","binary_name":"swift-object-expirer"},{"binary_version":"2.25.2-0ubuntu1.1","binary_name":"swift-proxy"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71190.json"}},{"package":{"name":"swift","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/swift?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.0+git2021090911.5d52afbe4-0ubuntu1","2.28.0+git2021120815.1859f2e16-0ubuntu1","2.28.0+git2021121320.876377435-0ubuntu1","2.28.0+git2022011309.32da73f5c-0ubuntu1","2.29.0+git2022030314.3ff3076ce-0ubuntu1","2.29.0+git2022030314.3ff3076ce-0ubuntu2","2.29.1-0ubuntu1","2.29.2-0ubuntu1","2.29.2-0ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-swift","binary_version":"2.29.2-0ubuntu1.1"},{"binary_name":"swift","binary_version":"2.29.2-0ubuntu1.1"},{"binary_version":"2.29.2-0ubuntu1.1","binary_name":"swift-account"},{"binary_name":"swift-container","binary_version":"2.29.2-0ubuntu1.1"},{"binary_name":"swift-object","binary_version":"2.29.2-0ubuntu1.1"},{"binary_name":"swift-object-expirer","binary_version":"2.29.2-0ubuntu1.1"},{"binary_name":"swift-proxy","binary_version":"2.29.2-0ubuntu1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71190.json"}},{"package":{"name":"swift","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/swift?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.32.0+git2023090714.8ce961ed-0ubuntu1","2.32.0+git2024021508.3aba22fd-0ubuntu1","2.32.0+git2024030809.4135133a-0ubuntu1","2.33.0-0ubuntu1","2.33.0-0ubuntu1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-swift","binary_version":"2.33.0-0ubuntu1.1"},{"binary_version":"2.33.0-0ubuntu1.1","binary_name":"swift"},{"binary_name":"swift-account","binary_version":"2.33.0-0ubuntu1.1"},{"binary_name":"swift-container","binary_version":"2.33.0-0ubuntu1.1"},{"binary_name":"swift-object","binary_version":"2.33.0-0ubuntu1.1"},{"binary_name":"swift-object-expirer","binary_version":"2.33.0-0ubuntu1.1"},{"binary_name":"swift-proxy","binary_version":"2.33.0-0ubuntu1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71190.json"}},{"package":{"name":"swift","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/swift?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.36.0-0ubuntu1","2.37.0-0ubuntu1","2.37.1-0ubuntu2","2.37.1-0ubuntu2.1"],"ecosystem_specific":{"binaries":[{"binary_name":"python3-swift","binary_version":"2.37.1-0ubuntu2.1"},{"binary_name":"swift","binary_version":"2.37.1-0ubuntu2.1"},{"binary_version":"2.37.1-0ubuntu2.1","binary_name":"swift-account"},{"binary_name":"swift-container","binary_version":"2.37.1-0ubuntu2.1"},{"binary_name":"swift-object","binary_version":"2.37.1-0ubuntu2.1"},{"binary_name":"swift-object-expirer","binary_version":"2.37.1-0ubuntu2.1"},{"binary_version":"2.37.1-0ubuntu2.1","binary_name":"swift-proxy"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71190.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}