---
id: CVE-2026-49017
title: >-
  In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an
  infinite loop when processing a truncated aws-chunked PUT request body
summary: >-
  In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an
  infinite loop when processing a truncated aws-chunked PUT request body. The
  StreamingInput class repeatedly appends an empty buffer and re-reads, causing
  the proxy-s…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: openstack
product: swift
affected:
  - 'swift >= 2.35.1, < 2.35.3'
  - 'swift >= 2.36.0, < 2.36.2'
  - 'swift >= 2.37.0, < 2.37.2'
patched:
  - swift 2.37.2
published: '2026-05-27'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T17:25:35.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49017'
references:
  - url: 'https://bugs.launchpad.net/bugs/2152205'
    label: cve@mitre.org
  - url: 'https://review.opendev.org/c/openstack/swift/+/987957'
    label: cve@mitre.org
  - url: 'https://review.opendev.org/c/openstack/swift/+/988093'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/05/27/9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/02/6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49017'
  - url: 'https://github.com/openstack/swift'
tags:
  - nvd
  - osv
  - pip
epss: 0.00322
epssPercentile: 0.25444
aliases:
  - GHSA-g7jq-j257-rww2
  - PYSEC-2026-3080
ecosystem: pip
ingestedAt: '2026-07-13T18:57:58.136Z'
---

## Overview

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

## Affected

- `swift >= 2.35.1, < 2.35.3`
- `swift >= 2.36.0, < 2.36.2`
- `swift >= 2.37.0, < 2.37.2`

## Remediation

Upgrade past the affected range:

- `swift 2.37.2`

## Package advisory (CVE-2026-49017)

Affected packages:

- `swift >= 2.36.0, <= 2.36.1`
- `swift >= 2.37.0, <= 2.37.1`

Source: https://osv.dev/vulnerability/GHSA-g7jq-j257-rww2