CyberRota Analysis
AI-GeneratedOpenStack Swift versions up to 2.38.0 are vulnerable due to a flaw in the proxy server's Accept header parser, which is susceptible to catastrophic backtracking, leading to denial of service (DoS) through excessive CPU consumption. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted Accept headers, potentially exhausting all proxy worker threads. Organizations using affected versions of OpenStack Swift should prioritize patching to mitigate the risk of service disruption.
Original NVD Description
In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS). The "qdtext" pattern (?:[^"]|\\.)* allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in the proxy worker. A payload of 32 backslash-character pairs exceeds 30 seconds of CPU time. No authentication is required. Repeated requests can exhaust all proxy worker threads, resulting in a complete denial of service.