~ / search / GHSA-g7jq-j257-rww2

GHSA-g7jq-j257-rww2

OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body

Source: GitHub Advisory Database (reviewed) High CVE-2026-49017

Packages

EcosystemPackageAffectedFixed in
PyPI swift >= 2.36.0, <= 2.36.1 no fix listed
PyPI swift >= 2.37.0, <= 2.37.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

References

External links from the advisory. They lead to third-party sites.