← Vulnerability feed

Vulnerability record · CVE-2016-0738 · published 29 January 2016

CVE-2016-0738: Openstack swift vulnerability

Openstack · Swift

OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

7.5 CVSS 3.0 High EPSS 3.9% · top 10.2% CWE-399 · CWE-399
7.5CVSS 3.0 base score, v2 5.0
3.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
17 Jun 2026Last modified by NVD

Description

OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176713.html
http://rhn.redhat.com/errata/RHSA-2016-0128.html
http://rhn.redhat.com/errata/RHSA-2016-0155.html
http://rhn.redhat.com/errata/RHSA-2016-0329.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/81432
https://bugs.launchpad.net/cloud-archive/+bug/1493303 Vendor Advisory
https://github.com/openstack/swift/blob/master/CHANGELOG Vendor Advisory
https://security.openstack.org/ossa/OSSA-2016-004.html PatchVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176713.html
http://rhn.redhat.com/errata/RHSA-2016-0128.html
http://rhn.redhat.com/errata/RHSA-2016-0155.html
http://rhn.redhat.com/errata/RHSA-2016-0329.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/81432
https://bugs.launchpad.net/cloud-archive/+bug/1493303 Vendor Advisory
https://github.com/openstack/swift/blob/master/CHANGELOG Vendor Advisory
https://security.openstack.org/ossa/OSSA-2016-004.html PatchVendor Advisory

Track CVE-2016-0738 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-16613Openstack swauth improper authentication vulnerabilityAn issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and …EPSS 8.4%9.8CVE-2012-4406Openstack swift deserialization of untrusted data vulnerabilityOpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memca…EPSS 6.6%7.5CVE-2016-0737Openstack swift vulnerabilityOpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service …EPSS 3.8%7.1CVE-2026-49017Openstack swift vulnerabilityIn OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The S…EPSS 0.36%6.5CVE-2022-47950Openstack swift vulnerabilityAn issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may…EPSS 1.0%5.8CVE-2013-6396Openstack swift vulnerabilityThe OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allow…EPSS 0.74%5.5CVE-2015-1856Openstack swift permissions and access controls vulnerabilityOpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an…EPSS 4.0%5.3CVE-2026-50221Openstack swift server-side request forgery (ssrf) vulnerabilityIn OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Dele…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2016-0738), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.