Executive brief
OpenStack Swift, a widely used cloud storage system, contains a flaw in how it handles certain data upload requests. An authorized user can send a specially crafted or interrupted upload request that causes the storage server to enter an infinite loop. This leads to high CPU and memory usage, eventually making the service unresponsive and resulting in a denial of service for all users.
Technical details
An infinite loop vulnerability exists in the s3api middleware of OpenStack Swift within the StreamingInput class. When processing an 'aws-chunked' PUT request body that is truncated (e.g., due to a closed socket or malformed payload), the class repeatedly appends an empty buffer and attempts to re-read, failing to reach an exit condition. An authenticated attacker can exploit this by sending multiple truncated requests to exhaust all proxy-server worker processes, causing them to become permanently unresponsive with high CPU and memory consumption. The issue was introduced in version 2.36.0 and is addressed in versions 2.36.2 and 2.37.2.
Affected products
- OpenStack Swift >= 2.36.0, < 2.36.2; >= 2.37.0, < 2.37.2; >= 2.35.1, < 2.35.3
Timeline
- 2026-05-11: disclosed: Bug reported to OpenStack Launchpad
- 2026-05-27: advisory: GitHub Advisory and NVD entry published