CVE-2026-49017

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

• CWE-835

• https://bugs.launchpad.net/bugs/2152205Issue Tracking, Vendor Advisory
• https://review.opendev.org/c/openstack/swift/+/987957Issue Tracking, Patch
• https://review.opendev.org/c/openstack/swift/+/988093Issue Tracking, Patch
• https://www.openwall.com/lists/oss-security/2026/05/27/9Mailing List, Patch, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2026/06/02/6Mailing List, Patch, Third Party Advisory

Published

May 27, 2026

Last Modified

Sep 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49006By accessing unencrypted information in the device firmware,…5.3
• CVE-2026-49007By accessing unencrypted information in the device firmware,…7.5
• CVE-2026-49008By accessing unencrypted information in the device firmware,…6.5
• CVE-2026-49009Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fi…3.1
• CVE-2026-4901AlanWeb SCADA saves sensitive information into a log file. C…6.5
• CVE-2026-49014In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in t…7.8
• CVE-2026-4902A vulnerability was detected in Tenda AC5 15.03.06.47. This …8.8
• CVE-2026-4903A flaw has been found in Tenda AC5 15.03.06.47. This vulnera…8.8
• CVE-2026-49030Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2026-49033The application contains a stack-based buffer overflow vulne…8.4
• CVE-2026-49035The affected product is vulnerable to a heap-based buffer ov…9.2
• CVE-2026-4904A vulnerability has been found in Tenda AC5 15.03.06.47. Thi…8.8