SW
Product
Swift
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 3Medium 7Low 0
Watch
Add Swift to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-16613 | 9.8 | Nov 21 | An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1 Affected: through 2.15.1 |
| CVE-2012-4406 | 9.8 | Oct 22 | OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote… Affected: before 1.7.0 |
| CVE-2026-71190 | 8.7 | Aug 5 | In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking (ReDoS) Affected: 1.9.1 before 2.35.4; 2.36.0 before 2.36.3; 2.37.0 before 2.37.3; 2.38.0 |
| CVE-2016-0738 | 7.5 | Jan 29 | OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a… Affected: through 2.3.0; 2.4.0; 2.5.0 |
| CVE-2016-0737 | 7.5 | Jan 29 | OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource… Affected: through 2.3.0 |
| CVE-2026-49017 | 6.5 | May 27 | In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body Affected: 2.36.0 before 2.36.2; 2.37.0 before 2.37.2; 2.35.1 before 2.35.3 |
| CVE-2022-47950 | 6.5 | Jan 18 | An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0 Affected: before 2.28.1; 2.29.0 before 2.29.2; 2.30.0 |
| CVE-2026-71192 | 6.0 | Aug 5 | In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true Affected: 2.18.0 before 2.35.4; 2.36.0 before 2.36.3; 2.37.0 before 2.37.3; 2.38.0 |
| CVE-2026-71191 | 6.0 | Aug 5 | In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests Affected: 2.18.0 before 2.35.4; 2.36.0 before 2.36.3; 2.37.0 before 2.37.3; 2.38.0 |
| CVE-2026-50221 | 5.4 | Jun 23 | In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client… Affected: 2.0.0 before 2.35.3; 2.36.0 before 2.36.2; 2.37.0 before 2.37.2 |
| CVE-2026-97149 | 5.3 | Sep 24 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests Affected: 2.4.0 before 2.35.5; 2.36.0 before 2.36.4; 2.37.0 before 2.37.4; 2.38.0 before 2.38.2 |
| CVE-2017-8761 | 4.3 | Jun 2 | In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read… Affected: through 2.10.1; 2.11.0 through 2.13.0; 2.14.0 |
| CVE-2015-5223 | – | Oct 26 | OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another… Affected: through 2.3.0 |
| CVE-2015-1856 | – | Apr 17 | OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing… Affected: through 2.2.2 |
| CVE-2014-7960 | – | Oct 17 | OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints via multiple crafted requests which… Affected: through 2.1.0 |
| CVE-2014-3497 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header Affected: 1.11.0; 1.12.0; 1.13.0; 1.13.1; 1.13.1; 1.13.1 |
| CVE-2013-6396 | – | Feb 18 | The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers… Affected: 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.0; 1.1.0; +28 more |
| CVE-2014-0006 | – | Jan 23 | The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an… Affected: 1.4.6; 1.4.7; 1.4.8; 1.5.0; 1.6.0; 1.7.0; +10 more |
| CVE-2013-4155 | – | Aug 20 | OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster… Affected: through 1.9.0; 1.0.0; 1.0.1; 1.0.2; 1.1.0; 1.1.0; +26 more |
Showing 19