Loading story…
OpenStack disclosed OSSA-2026-031, a denial-of-service flaw in the Swift proxy server that lets an unauthenticated attacker make object storage services unavailable by sending crafted HTTP requests. The issue stems from catastrophic regular-expression backtracking in Swift’s Accept header parser, which can consume proxy worker threads until the service stops responding.
The vulnerability affects Swift versions >=1.9.1 and <2.35.4, >=2.36.0 and <2.36.3, >=2.37.0 and <2.37.3, and 2.38.0, and was tracked at disclosure as CVE-2026-pending. OpenStack published fixed releases and patches for the 2025.1, 2025.2, 2026.1, and 2026.2 development branches, and the issue was reported by Christian Schwede of NVIDIA through bug #2158771 before public advisory release.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside OSSA-2026-031, OpenStack published patches for the 2025.1 epoxy, 2025.2 flamingo, 2026.1 gazpacho, and 2026.2 hibiscus development branches to address the Swift proxy denial-of-service vulnerability.
OpenStack published security advisory OSSA-2026-031 describing a denial-of-service flaw in the Swift proxy server's Accept header parser caused by catastrophic regular expression backtracking. The issue, tracked as CVE-2026-pending, allows an unauthenticated attacker to send crafted requests that exhaust proxy worker threads and make the service unavailable.
A Launchpad bug entry, 2158771, was published for an unauthenticated remote denial-of-service vulnerability in OpenStack Swift and was later referenced by the OpenStack advisory.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceopenwall.com
Open sourcelaunchpad.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenStack disclosed **OSSA-2026-031** for a denial-of-service flaw in the Swift proxy server, tracked as **`CVE-2026-71190`**, that lets an unauthenticated remote attacker exhaust CPU by sending a crafted `Accept` header. The issue stems from catastrophic backtracking in the proxy's regular-expression handling of the `qdtext` pattern, allowing a malicious request to tie up processing for extended periods and degrade or halt object storage access. The vulnerability affects Swift versions **1.9.1 before 2.35.4**, **2.36.0 before 2.36.3**, **2.37.0 before 2.37.3**, and **2.38.0**. OpenStack said a payload with **32 backslash-character pairs** can consume **more than 30 seconds of CPU time** per request, and repeated requests can exhaust proxy worker threads and cause complete service denial. The flaw is classified under **`CWE-1333`** and carries high availability impact, with the issue documented in OpenStack bug **#2158771** and the Swift security advisory.
Aug 5, 2026
OpenStack disclosed **OSSA-2026-036** for two authorization flaws in **Aodh** and **Watcher**, later tracked as **`CVE-2026-76878`** with a **CVSS 4.0 score of 8.4**. In Aodh, versions before **22.0.1** improperly enforced project scope in the alarm listing API, allowing a non-admin user with only the **reader** role to enumerate alarms from other projects by supplying the `all_projects` parameter with a false value. The exposure can reveal alarm metadata including webhook URLs, Heat signal endpoints, project IDs, and user IDs, and can be further narrowed by providing a foreign `project_id`. In Watcher, the webhook trigger endpoint lacked authorization checks, allowing any authenticated user who knows an audit webhook URL to start an **EVENT** audit and its associated action plan regardless of project or role. The advisory said affected Watcher deployments have carried the missing policy enforcement since the **Ussuri** release line, identified as **Watcher 4.0.0**, and that patches were issued across multiple OpenStack branches. The issues were reported by **Chen YuXiang** of the Institute of Computing Technology, Chinese Academy of Sciences.
Aug 20, 2026
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026