OpenStack Swift versions up to 2.38.0 contain a vulnerability in the proxy server's Accept header parser due to an inefficient regular expression pattern ("qdtext" pattern (?:[^"]|\\.)*). This pattern is susceptible to catastrophic backtracking, enabling an unauthenticated remote attacker to send a crafted Accept header that triggers exponential CPU usage in the proxy worker. A payload with 32 backslash-character pairs can cause over 30 seconds of CPU time consumption. Repeated exploitation can exhaust all proxy worker threads, resulting in a complete denial of service.

An unauthenticated attacker can cause a denial of service on the OpenStack Swift proxy server by sending specially crafted Accept headers that trigger excessive CPU usage. This can exhaust proxy worker threads, making the service unavailable. There is no requirement for authentication or user interaction, increasing the risk of exploitation. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing network-level protections such as rate limiting or filtering to mitigate potential denial of service attempts targeting the Accept header parsing. Monitor vendor communications for official patches or updates.