{"id":"CVE-2026-49017","title":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body","summary":"In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-s…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-835"],"vendor":"openstack","product":"swift","affected":["swift >= 2.35.1, < 2.35.3","swift >= 2.36.0, < 2.36.2","swift >= 2.37.0, < 2.37.2"],"patched":["swift 2.37.2"],"published":"2026-05-27","updated":"2026-09-24","sourceUpdated":"2026-09-24T17:25:35.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49017","references":[{"url":"https://bugs.launchpad.net/bugs/2152205","label":"cve@mitre.org"},{"url":"https://review.opendev.org/c/openstack/swift/+/987957","label":"cve@mitre.org"},{"url":"https://review.opendev.org/c/openstack/swift/+/988093","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/27/9","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/02/6","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49017"},{"url":"https://github.com/openstack/swift"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49017.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-49017"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481759"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49017"}],"tags":["nvd","osv","pip","csaf","vex","red-hat"],"epss":0.00358,"epssPercentile":0.29359,"aliases":["GHSA-g7jq-j257-rww2","PYSEC-2026-3080"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:57:58.136Z","slug":"CVE-2026-49017","body":"## Overview\n\nIn OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.\n\n## Affected\n\n- `swift >= 2.35.1, < 2.35.3`\n- `swift >= 2.36.0, < 2.36.2`\n- `swift >= 2.37.0, < 2.37.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `swift 2.37.2`\n\n## Package advisory (CVE-2026-49017)\n\nAffected packages:\n\n- `swift >= 2.36.0, <= 2.36.1`\n- `swift >= 2.37.0, <= 2.37.1`\n\nSource: https://osv.dev/vulnerability/GHSA-g7jq-j257-rww2\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49017.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":210296,"id":"CVE-2026-49017","ts":1790272145657,"field":"cvss","old":null,"new":"6.5"},{"seq":210295,"id":"CVE-2026-49017","ts":1790272145657,"field":"severity","old":"high","new":"medium"}]}