CVE-2026-71190
CVE-2026-71190: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-71190] Unauthenticated denial of service via catastrophic backtracking in Accept header parser
CVE-2026-71190Source published Source updated
Unauthenticated denial of service via catastrophic backtracking in Accept header parser. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-1333.
- Related products — impact not confirmed
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 2.38.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Deploy a reverse proxy (such as HAProxy, nginx, or Apache httpd) in front of the Swift proxy server and configure it to limit the size of the Accept request header. A limit of 256 bytes is sufficient for all legitimate Accept header values used by Swift clients. For example, in HAProxy: use 'http-request deny if { req.hdr(accept) -m len gt 256 }'. In nginx: use 'large_client_header_buffers' to restrict header size. Alternatively, a WAF rule can be deployed to reject Accept headers containing backslash characters in quoted strings without a closing quote, though the header size limit is simpler and more robust. Note that Swift's built-in max_header_size (default 8192 bytes) does NOT mitigate this vulnerability because the exponential backtracking is triggered with as few as 27 backslash-character pairs (~54 bytes). In Red Hat OpenStack Services on OpenShift (RHOSO) environments, the Swift API is deployed behind an OpenShift-managed HAProxy load balancer. The available OCP route annotations do not support custom header inspection rules such as 'http-request deny if', making the header size limit approach not feasible. Rate limiting via route annotations (e.g., rate-limit-connections.rate-http) provides only partial protection, as a single crafted request can still lock a proxy worker for minutes, and attackers using multiple source IPs can bypass per-IP limits. Additionally, default rate limits cannot be shipped as a mitigation because they would break deployer configurations. For RHOSO deployments, applying the upstream patch backport is the only effective remediation.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.