---
id: CVE-2026-71190
title: >-
  In OpenStack Swift through 2.38.0, the proxy server Accept header parser
  contains a regular expression vulnerable to catastrophic backtracking (ReDoS)
summary: >-
  In OpenStack Swift through 2.38.0, the proxy server Accept header parser
  contains a regular expression vulnerable to catastrophic backtracking (ReDoS).
  The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker
  to send …
severity: none
cwe:
  - CWE-1333
published: '2026-08-05'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:03:22.897'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71190'
references:
  - url: 'https://launchpad.net/bugs/2158771'
    label: cve@mitre.org
  - url: 'https://openwall.com/lists/oss-security/2026/07/28/27'
    label: cve@mitre.org
  - url: 'https://security.openstack.org/ossa/OSSA-2026-031.html'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/08/05/19'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00538
epssPercentile: 0.44237
ingestedAt: '2026-09-09T16:14:05.512Z'
---

## Overview

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.