CVE-2026-49017 OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
An authenticated attacker can cause a denial of service in OpenStack Swift by sending truncated aws-chunked PUT requests, exhausting proxy-server workers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49017?
CVE-2026-49017 is a high-severity denial of service vulnerability in OpenStack Swift, published on 27 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.
Weakness: CWE-835
Which versions are affected by CVE-2026-49017?
5 open source packages ship an affected version, including swift. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
swift PyPI | From 2.36.0 to 2.36.1 | None |
swift PyPI | From 2.36.0 to 2.36.1 | None |
swift PyPI | From 2.36.0 to 2.36.1 | None |
swift PyPI | From 2.37.0 to 2.37.1 | None |
swift PyPI | From 2.37.0 to 2.37.1 | None |
Products include Openstack Swift.
How do I fix CVE-2026-49017?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49017 being exploited?
There is no known exploitation of CVE-2026-49017 in the wild and no public exploit code.
Other vulnerabilities in OpenStack Swift
- CVE-2016-0737 OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
- CVE-2016-0738 OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
- CVE-2013-6396 Python Swift client is vulnerable to Missing SSL Certificate Check
- CVE-2026-50221 OpenStack Swift vulnerable to authenticated server-side request forgery
- CVE-2015-5223 OpenStack Object Storage (Swift) Sensitive Data Exposure
Sources
Also known as DEBIAN-CVE-2026-49017, GHSA-g7jq-j257-rww2, PYSEC-2026-3080, UBUNTU-CVE-2026-49017, USN-8821-1.