Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| swift | pip | >= 2.36.0, <= 2.36.1 | |
| swift | pip | >= 2.37.0, <= 2.37.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2026-49017, causes a denial of service in OpenStack Swift's s3api middleware. The root cause is an infinite loop within the StreamingInput class when handling truncated aws-chunked PUT requests. The provided patch for commit 58918e18e7863fc38c858075a8097ef1dcea3b7d clearly shows the fix. The change is in the _read_payload method within swift/common/middleware/s3api/s3request.py. Previously, the method would loop indefinitely if it received an empty buffer from the input stream before the payload was fully read. The patch adds a condition to detect this scenario and raise an S3InputIncomplete exception, effectively terminating the loop. The analysis of the patch directly points to StreamingInput._read_payload as the vulnerable function. The associated test files added in the same commit confirm this by simulating the exact conditions of a truncated request body that would trigger the vulnerability.
