OpenStack Swift versions 1.9.1, 2.36.0, 2.37.0, and 2.38.0 contain a vulnerability in the proxy server's Accept header parser due to an inefficient regular expression pattern (CWE-1333). The pattern "qdtext" (?:[^"]|\\.)* can be exploited by sending a crafted Accept header with repeated backslash-character pairs, causing exponential CPU usage (ReDoS). A payload with 32 such pairs can consume over 30 seconds of CPU time, potentially exhausting all proxy worker threads and resulting in a complete denial of service. The attack requires no authentication and can be executed remotely.

An unauthenticated remote attacker can cause a denial of service by sending specially crafted Accept headers to the OpenStack Swift proxy server. This triggers catastrophic backtracking in the regular expression parser, leading to exponential CPU consumption and exhaustion of proxy worker threads. This results in service unavailability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as rate limiting or filtering suspicious Accept headers to mitigate potential exploitation.