CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

• CWE-1333

• https://launchpad.net/bugs/2158771
• https://openwall.com/lists/oss-security/2026/07/28/27
• https://security.openstack.org/ossa/OSSA-2026-031.html
• https://www.openwall.com/lists/oss-security/2026/08/05/19

Published

Aug 5, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7118A security vulnerability has been detected in code-projects …6.3
• CVE-2026-71180Dell Update Package Framework, versions prior to 26.07.03, c…7.8
• CVE-2026-71181Dell Update Package Framework, versions prior to 26.07.03, c…6
• CVE-2026-71182Dell Update Package Framework, versions prior to 26.07.03, c…6
• CVE-2026-71187The Ebyte device relies on client side authentication logic …9.8
• CVE-2026-7119A vulnerability was detected in Tenda HG3 2.0. The impacted …8.8
• CVE-2026-71191In OpenStack Swift through 2.38.0, S3API middleware does not…6
• CVE-2026-71192In OpenStack Swift through 2.38.0, the S3API middleware does…6
• CVE-2026-71193In OpenStack Designate before 22.0.1, zone creation checks (…9.6
• CVE-2026-71194In OpenStack Designate before 22.0.2, the mDNS handler perfo…6.8
• CVE-2026-71198In OpenStack Glance before 32.0.1, the location API does not…7
• CVE-2026-7120@fastify/static evaluates the allowedPath callback before no…5.3