OSSA-2026-031: Swift proxy denial of service via Accept header

Date:

July 28, 2026

CVE:

CVE-2026-71190

Affects

• Swift: >=1.9.1 <2.35.4, >=2.36.0 <2.36.3, >=2.37.0 <2.37.3, ==2.38.0

Description

Christian Schwede from NVIDIA reported a denial of service vulnerability in Swift’s proxy server. The Accept header parser is vulnerable to catastrophic regular expression backtracking. An unauthenticated attacker can send crafted requests that exhaust proxy worker threads, rendering the service unavailable. All deployments running Swift proxy with versions between 1.9.1 and the fixed releases listed below are affected.

Errata

CVE-2026-71190 has been assigned for this vulnerability.

Patches

• https://review.opendev.org/998953 (2025.1/epoxy)

• https://review.opendev.org/998952 (2025.2/flamingo)

• https://review.opendev.org/998951 (2026.1/gazpacho)

• https://review.opendev.org/998950 (2026.2/hibiscus (development))

Credits

• Christian Schwede from NVIDIA

References

• https://launchpad.net/bugs/2158771

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-71190

OSSA History

• 2026-08-05 - Errata 1

• 2026-07-28 - Original Version