Login Request a demo
SW
Product
Swift
by OpenStack · last CVE Sep 24, 2026
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 2High 3Medium 7Low 0
Severity
All severities19Critical2High3Medium7Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Swift to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-49017
6.5
0%
May 27
In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body
Affected: 2.36.0 before 2.36.2; 2.37.0 before 2.37.2; 2.35.1 before 2.35.3
CVE-2022-47950
6.5
1%
Jan 18
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0
Affected: before 2.28.1; 2.29.0 before 2.29.2; 2.30.0
CVE-2026-71192
6.0
0%
Aug 5
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) from S3 API requests when s3_acl=true
Affected: 2.18.0 before 2.35.4; 2.36.0 before 2.36.3; 2.37.0 before 2.37.3; 2.38.0
CVE-2026-71191
6.0
1%
Aug 5
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on presigned URL requests
Affected: 2.18.0 before 2.35.4; 2.36.0 before 2.36.3; 2.37.0 before 2.37.3; 2.38.0
CVE-2026-50221
5.4
0%
Jun 23
In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client…
Affected: 2.0.0 before 2.35.3; 2.36.0 before 2.36.2; 2.37.0 before 2.37.2
CVE-2026-97149
5.3
0%
Sep 24
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests
Affected: 2.4.0 before 2.35.5; 2.36.0 before 2.36.4; 2.37.0 before 2.37.4; 2.38.0 before 2.38.2
CVE-2017-8761
4.3
1%
Jun 2
In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read…
Affected: through 2.10.1; 2.11.0 through 2.13.0; 2.14.0
Showing 7