Is CVE-2026-49017 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49017 being exploited in the wild.

How severe is CVE-2026-49017?

High severity, with a CVSS score of 4, published 27 May 2026.

Which products and versions are affected?

OpenStack Swift >= 2.36.0, = 2.37.0, = 2.35.1, < 2.35.3, 2.36.0 through 2.36.1, 2.37.0 through 2.37.1; swift (PyPI) ECOSYSTEM:introduced=2.36.0,last_affected=2.36.1, ECOSYSTEM:introduced=2.36.0,last_affected=2.36.1,introduced=2.37.0,last_affected=2.37.1.

Is there a fix for CVE-2026-49017?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49017 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49017?

Check whether you run OpenStack Swift or swift (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49017: OpenStack Swift infinite loop in s3api middleware via truncated PUT request

Q: Is there a fix for CVE-2026-49017?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-49017 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49017?

Check whether you run OpenStack Swift or swift (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49017 · Severity: high · CVSS 4 · Published 2026-05-27

OpenStack Swift, a widely used cloud storage system, contains a flaw in how it handles certain data upload requests. An authorized user can send a specially crafted or interrupted upload request that causes the storage server to enter an infinite loop. This leads to high CPU and memory usage, eventually making the service unresponsive and resulting in a denial of service for all users.

Technologies: OpenStack Swift, swift (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-49017 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49017 being exploited in the wild.
How severe is CVE-2026-49017?: High severity, with a CVSS score of 4, published 27 May 2026.
Which products and versions are affected?: OpenStack Swift >= 2.36.0, < 2.36.2; >= 2.37.0, < 2.37.2; >= 2.35.1, < 2.35.3, 2.36.0 through 2.36.1, 2.37.0 through 2.37.1; swift (PyPI) ECOSYSTEM:introduced=2.36.0,last_affected=2.36.1, ECOSYSTEM:introduced=2.36.0,last_affected=2.36.1,introduced=2.37.0,last_affected=2.37.1.
Is there a fix for CVE-2026-49017?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49017 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49017?: Check whether you run OpenStack Swift or swift (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An infinite loop vulnerability exists in the s3api middleware of OpenStack Swift within the StreamingInput class. When processing an 'aws-chunked' PUT request body that is truncated (e.g., due to a closed socket or malformed payload), the class repeatedly appends an empty buffer and attempts to re-read, failing to reach an exit condition. An authenticated attacker can exploit this by sending multiple truncated requests to exhaust all proxy-server worker processes, causing them to become permanently unresponsive with high CPU and memory consumption. The issue was introduced in version 2.36.0 and is addressed in versions 2.36.2 and 2.37.2.

Affected products

OpenStack Swift >= 2.36.0, < 2.36.2; >= 2.37.0, < 2.37.2; >= 2.35.1, < 2.35.3

Identifiers

CVE-2026-49017
GHSA-g7jq-j257-rww2
PYSEC-2026-3080

Timeline

2026-05-11: disclosed: Bug reported to OpenStack Launchpad
2026-05-27: advisory: GitHub Advisory and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.