Loading story…
OpenStack disclosed OSSA-2026-031 for a denial-of-service flaw in the Swift proxy server, tracked as CVE-2026-71190, that lets an unauthenticated remote attacker exhaust CPU by sending a crafted Accept header. The issue stems from catastrophic backtracking in the proxy's regular-expression handling of the qdtext pattern, allowing a malicious request to tie up processing for extended periods and degrade or halt object storage access.
The vulnerability affects Swift versions 1.9.1 before 2.35.4, 2.36.0 before 2.36.3, 2.37.0 before 2.37.3, and 2.38.0. OpenStack said a payload with 32 backslash-character pairs can consume more than 30 seconds of CPU time per request, and repeated requests can exhaust proxy worker threads and cause complete service denial. The flaw is classified under CWE-1333 and carries high availability impact, with the issue documented in OpenStack bug #2158771 and the Swift security advisory.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
MITRE received the CVE-2026-71190 record for an OpenStack Swift regular expression denial-of-service flaw in the proxy server's Accept header parser. The issue affects multiple Swift branches through 2.38.0 and can be exploited remotely without authentication.
OpenStack published security advisory OSSA-2026-031 covering a Swift proxy denial-of-service vulnerability via the Accept header parser.
An oss-security mailing list post about the OpenStack Swift proxy denial-of-service vulnerability was dated 2026-07-28 and later referenced by the CVE record.
A Launchpad bug entry, bug 2158771, was published for an unauthenticated remote denial-of-service issue in OpenStack Swift related to malformed Accept headers.
An OpenDev code review was opened for a patch addressing the OpenStack Swift proxy denial-of-service issue caused by malformed Accept header parsing. This represents the remediation step following the bug report and advisory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourcesecurity.openstack.org
Open sourcelaunchpad.net
Open sourcereview.opendev.org
Open sourcereview.opendev.org
Open sourcereview.opendev.org
Open sourcereview.opendev.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenStack disclosed **OSSA-2026-031**, a denial-of-service flaw in the **Swift proxy server** that lets an unauthenticated attacker make object storage services unavailable by sending crafted HTTP requests. The issue stems from **catastrophic regular-expression backtracking** in Swift’s `Accept` header parser, which can consume proxy worker threads until the service stops responding. The vulnerability affects Swift versions `>=1.9.1 and <2.35.4`, `>=2.36.0 and <2.36.3`, `>=2.37.0 and <2.37.3`, and `2.38.0`, and was tracked at disclosure as **`CVE-2026-pending`**. OpenStack published fixed releases and patches for the **2025.1**, **2025.2**, **2026.1**, and **2026.2** development branches, and the issue was reported by **Christian Schwede of NVIDIA** through bug **`#2158771`** before public advisory release.
Aug 5, 2026
Red Hat disclosed two high-severity request smuggling vulnerabilities in **Undertow**, tracked as `CVE-2026-28367` and `CVE-2026-28368`, that let remote attackers exploit parsing differences between Undertow and upstream proxies. Both issues are classified as `CWE-444` and carry a CVSS v3.1 vector of `AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N`, indicating network-reachable attacks with high confidentiality and integrity impact. `CVE-2026-28367` allows attackers to use `\r\r\r` as a header block terminator to smuggle requests when Undertow sits behind certain proxy servers, with older versions of **Apache Traffic Server** and **Google Cloud Classic Application Load Balancer** specifically cited as exposed configurations. `CVE-2026-28368` stems from inconsistent header-name parsing between Undertow and upstream proxies, creating another path to bypass security controls and reach unauthorized resources through crafted requests.
Jun 29, 2026
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026