OpenStack Swift versions prior to 2.36.2 and 2.37.2 contain a vulnerability (CWE-835) in the s3api middleware where processing a truncated aws-chunked PUT request body causes the StreamingInput class to enter an infinite loop. This loop repeatedly appends an empty buffer and re-reads the input, causing the proxy-server worker to become permanently unresponsive with escalating CPU and memory consumption. The vulnerability allows an authenticated attacker to systematically exhaust proxy-server workers, resulting in denial of service. The defect was introduced in version 2.36.0 and affects cloud-hosted Swift services.

An authenticated attacker can exploit this vulnerability to cause denial of service by exhausting all proxy-server workers in OpenStack Swift, making the service unresponsive and consuming excessive CPU and memory resources. This impacts availability of the Swift proxy service.

A patch is available for this vulnerability. Since OpenStack Swift is a cloud-hosted service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that their cloud service has been updated to versions 2.36.2 or 2.37.2 or later to mitigate this issue. Patch status is not explicitly detailed in the advisory, so users should check the vendor advisory for current remediation guidance.