Version in base suite: 2.35.1-0+deb13u2 Base version: swift_2.35.1-0+deb13u2 Target version: swift_2.35.1-0+deb13u3 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/swift/swift_2.35.1-0+deb13u2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/swift/swift_2.35.1-0+deb13u3.dsc changelog | 17 + patches/CVE-2026-50221-stable-2025.1_Block-internal-update-headers-at-the-gatekeeper.patch | 79 +++++ patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch | 95 +++++++ patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch | 133 ++++++++++ patches/CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch | 69 +++++ patches/series | 4 6 files changed, 397 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpgc8mvpks/swift_2.35.1-0+deb13u2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpgc8mvpks/swift_2.35.1-0+deb13u3.dsc: no acceptable signature found diff -Nru swift-2.35.1/debian/changelog swift-2.35.1/debian/changelog --- swift-2.35.1/debian/changelog 2026-05-28 17:00:54.000000000 +0000 +++ swift-2.35.1/debian/changelog 2026-08-17 09:01:41.000000000 +0000 @@ -1,3 +1,20 @@ +swift (2.35.1-0+deb13u3) trixie-security; urgency=medium + + * CVE-2026-71191 / OSSA-2026-030: Swift S3API header authorization bypass. + Applied upstream patch: + - "s3api: require signing of sensitive SigV4 x-amz headers" + - "s3api: drop native Swift control headers from client requests" + (Closes: #1142972). + * CVE-2026-71192 / OSSA-2026-031: proxy denial of service via Accept header. + Applied upstream patch: + - "swob: avoid excessive backtracking in Accept parser" + (Closes: #1142973). + * CVE-2026-50221: Swift proxy-server SSRF via internal update header + injection: applied upstream patch: Block internal update headers at the + gatekeeper (Closes: #1140678). + + -- Thomas Goirand Mon, 17 Aug 2026 11:01:41 +0200 + swift (2.35.1-0+deb13u2) trixie-security; urgency=medium * CVE-2026-49017: Swift proxy-server denial of service via truncated s3api diff -Nru swift-2.35.1/debian/patches/CVE-2026-50221-stable-2025.1_Block-internal-update-headers-at-the-gatekeeper.patch swift-2.35.1/debian/patches/CVE-2026-50221-stable-2025.1_Block-internal-update-headers-at-the-gatekeeper.patch --- swift-2.35.1/debian/patches/CVE-2026-50221-stable-2025.1_Block-internal-update-headers-at-the-gatekeeper.patch 1970-01-01 00:00:00.000000000 +0000 +++ swift-2.35.1/debian/patches/CVE-2026-50221-stable-2025.1_Block-internal-update-headers-at-the-gatekeeper.patch 2026-08-17 09:01:41.000000000 +0000 @@ -0,0 +1,79 @@ +Author: Goutham Pacha Ravi +Date: Mon, 8 Jun 2026 00:19:27 -0400 +Subject: CVE-2026-50221: Block internal update headers at the gatekeeper + The proxy-server's gatekeeper middleware did not strip internal + container and expiry update headers (X-Container-Host, + X-Container-Device, X-Delete-At-Host, X-Delete-At-Device, and + related headers) from client requests. An authenticated user with + write access could inject these headers to redirect container + update requests, enabling server-side request forgery. + . + Strip these headers at the gatekeeper before they reach any + downstream middleware or the proxy-server application. +Bug: https://bugs.launchpad.net/swift/+bug/2150261 +Bug-Debian: https://bugs.debian.org/1140678 +Signed-off-by: Goutham Pacha Ravi +Origin: upstream, pre-OSSA mailing list +Last-Update: 2026-06-10 + +diff --git a/swift/common/middleware/gatekeeper.py b/swift/common/middleware/gatekeeper.py +index dfb5ef04b..8e2583202 100644 +--- a/swift/common/middleware/gatekeeper.py ++++ b/swift/common/middleware/gatekeeper.py +@@ -48,11 +48,17 @@ import re + # If adding to this list, note that these are regex patterns, + # so use a trailing $ to constrain to an exact header match + # rather than prefix match. +-inbound_exclusions = [get_sys_meta_prefix('account'), +- get_sys_meta_prefix('container'), +- get_sys_meta_prefix('object'), +- OBJECT_TRANSIENT_SYSMETA_PREFIX, +- 'x-backend'] ++inbound_exclusions = [ ++ get_sys_meta_prefix('account'), ++ get_sys_meta_prefix('container'), ++ get_sys_meta_prefix('object'), ++ OBJECT_TRANSIENT_SYSMETA_PREFIX, ++ 'x-backend', ++ # Block any update headers that predate x-backend headers ++ 'x-account-(host|device|partition)$', ++ 'x-container-(host|device|partition|root-db-state)$', ++ 'x-delete-at-(host|device|partition|container)$', ++] + + + #: A list of python regular expressions that will be used to +diff --git a/test/unit/common/middleware/test_gatekeeper.py b/test/unit/common/middleware/test_gatekeeper.py +index 4f8cb480b..735abec0a 100644 +--- a/test/unit/common/middleware/test_gatekeeper.py ++++ b/test/unit/common/middleware/test_gatekeeper.py +@@ -74,6 +74,18 @@ class TestGatekeeper(unittest.TestCase): + x_backend_headers = {'X-Backend-Replication': 'true', + 'X-Backend-Replication-Headers': 'stuff'} + ++ update_headers = {'X-Account-Host': 'localhost:8888', ++ 'X-Account-Device': 'stuff', ++ 'X-Account-Partition': '0', ++ 'X-Container-Host': 'localhost:8888', ++ 'X-Container-Device': 'stuff', ++ 'X-Container-Partition': '0', ++ 'X-Container-Root-Db-State': 'stuff', ++ 'X-Delete-At-Host': 'localhost:8888', ++ 'X-Delete-At-Container': 'stuff', ++ 'X-Delete-At-Device': 'stuff', ++ 'X-Delete-At-Partition': '0'} ++ + object_transient_sysmeta_headers = { + 'x-object-transient-sysmeta-': 'value', + 'x-object-transient-sysmeta-foo': 'value'} +@@ -82,6 +94,7 @@ class TestGatekeeper(unittest.TestCase): + forbidden_headers_out = dict(sysmeta_headers) + forbidden_headers_out.update(x_backend_headers) + forbidden_headers_out.update(object_transient_sysmeta_headers) ++ forbidden_headers_out.update(update_headers) + forbidden_headers_in = dict(forbidden_headers_out) + shunted_headers_in = dict(x_timestamp_headers) + +-- +2.50.1 (Apple Git-155) + diff -Nru swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch --- swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch 1970-01-01 00:00:00.000000000 +0000 +++ swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch 2026-08-17 09:01:41.000000000 +0000 @@ -0,0 +1,95 @@ +Subject: [PATCH 2/2] s3api: drop native Swift control headers from client requests + Strip client-supplied X-Copy-From(-Account), X-Symlink-Target(-Account), + X-Object-Manifest and X-Static-Large-Object before the Swift subrequest, + so they can't bypass S3 ACL checks. Headers s3api sets itself (e.g. + X-Copy-From from x-amz-copy-source) are added later and stay trusted. +Author: Christian Schwede +Date: Fri, 3 Jul 2026 15:09:41 +0000 +Change-Id: Ib1a2c3d4e5f60718293a4b5c6d7e8f9012345678 +Co-Authored-By: Claude Fable 5 +Signed-off-by: Christian Schwede +Bug: https://launchpad.net/bugs/2158733 +Bug-Debian: https://bugs.debian.org/1142972 +Origin: upstream, https://review.opendev.org/c/openstack/swift/+/998949 +Last-Update: 2026-07-22 + +diff --git a/swift/common/middleware/s3api/s3request.py b/swift/common/middleware/s3api/s3request.py +index ad8329ac2..a52d09f77 100644 +--- a/swift/common/middleware/s3api/s3request.py ++++ b/swift/common/middleware/s3api/s3request.py +@@ -102,6 +102,16 @@ SIGV4_MUST_BE_SIGNED_AMZ_PREFIXES = ( + ) + + ++DISALLOWED_CLIENT_HEADERS = frozenset(( ++ 'x-copy-from', ++ 'x-copy-from-account', ++ 'x-symlink-target', ++ 'x-symlink-target-account', ++ 'x-object-manifest', ++ 'x-static-large-object', ++)) ++ ++ + CHECKSUMS_BY_HEADER = { + 'x-amz-checksum-crc32': checksum.crc32, + 'x-amz-checksum-crc32c': checksum.crc32c, +@@ -1121,6 +1131,10 @@ class S3Request(swob.Request): + # by full URL when absolute path given. See swift.swob for more detail. + self.environ['swift.leave_relative_location'] = True + ++ for header in list(self.headers): ++ if header.lower() in DISALLOWED_CLIENT_HEADERS: ++ self.headers.pop(header, None) ++ + def validate_part_number(self, parts_count=None, check_max=True): + """ + Get the partNumber param, if it exists, and check it is valid. +diff --git a/test/unit/common/middleware/s3api/test_s3request.py b/test/unit/common/middleware/s3api/test_s3request.py +index 9a3b604a6..5baacd58d 100644 +--- a/test/unit/common/middleware/s3api/test_s3request.py ++++ b/test/unit/common/middleware/s3api/test_s3request.py +@@ -269,6 +269,40 @@ class TestRequest(S3ApiTestCase): + self.assertNotIn('s3api.auth_details', sw_req.environ) + self.assertNotIn('X-Auth-Token', sw_req.headers) + ++ def test_disallowed_client_headers_are_dropped(self): ++ smuggled = { ++ 'X-Copy-From': '/other/object', ++ 'X-Copy-From-Account': 'AUTH_victim', ++ 'X-Object-Manifest': 'other/prefix', ++ 'X-Static-Large-Object': 'True', ++ 'X-Symlink-Target': 'other/object', ++ 'X-Symlink-Target-Account': 'AUTH_victim', ++ } ++ headers = {'Authorization': 'AWS test:tester:hmac', ++ 'Date': self.get_date_header()} ++ headers.update(smuggled) ++ req = Request.blank('/bucket/object', method='PUT', headers=headers) ++ s3_req = S3Request(req.environ) ++ for header in smuggled: ++ self.assertNotIn(header, s3_req.headers) ++ sw_req = s3_req.to_swift_req('PUT', 'bucket', 'object') ++ for header in smuggled: ++ self.assertNotIn(header, sw_req.headers) ++ ++ def test_s3api_generated_copy_from_is_preserved(self): ++ # A client-supplied X-Copy-From is dropped, but the X-Copy-From that ++ # S3 API derives from x-amz-copy-source is added afterwards and kept. ++ req = Request.blank('/bucket/object', method='PUT', headers={ ++ 'Authorization': 'AWS test:tester:hmac', ++ 'Date': self.get_date_header(), ++ 'X-Amz-Copy-Source': '/srcbucket/srcobj', ++ 'X-Copy-From': '/attacker/object', ++ }) ++ s3_req = S3Request(req.environ) ++ self.assertNotIn('X-Copy-From', s3_req.headers) ++ sw_req = s3_req.to_swift_req('PUT', 'bucket', 'object') ++ self.assertEqual('/srcbucket/srcobj', sw_req.headers['X-Copy-From']) ++ + def test_to_swift_req_subrequest_proxy_access_log(self): + container = 'bucket' + obj = 'obj' +-- +2.55.0 + diff -Nru swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch --- swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch 1970-01-01 00:00:00.000000000 +0000 +++ swift-2.35.1/debian/patches/CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch 2026-08-17 09:01:41.000000000 +0000 @@ -0,0 +1,133 @@ +Description: CVE-2026-pending1 s3api: require signing of sensitive SigV4 x-amz headers + SigV4 accepted unsigned x-amz-* headers alongside a valid signature, so a + presigned URL could be extended with e.g. an unsigned x-amz-copy-source. + Reject unsigned x-amz-* headers that change request semantics: copy, acl, + grant and meta (also covers x-amz-metadata-directive). + . + Narrow denylist for now; full x-amz-* signing (AWS parity) can follow. +Author: Christian Schwede +Date: Fri, 3 Jul 2026 15:54:10 +0000 +Change-Id: I7292ede9100fdfdd1063e68f9fadedd36e72c3d3 +Co-Authored-By: Claude Fable 5 +Signed-off-by: Christian Schwede +Bug: https://launchpad.net/bugs/2158733 +Bug-Debian: https://bugs.debian.org/1142972 +Origin: upstream, https://review.opendev.org/c/openstack/swift/+/998948 +Last-Update: 2026-07-22 + +diff --git a/swift/common/middleware/s3api/s3request.py b/swift/common/middleware/s3api/s3request.py +index 8d425284a..ad8329ac2 100644 +--- a/swift/common/middleware/s3api/s3request.py ++++ b/swift/common/middleware/s3api/s3request.py +@@ -94,6 +94,14 @@ SIGV4_CHUNK_MIN_SIZE = 8192 + SERVICE = 's3' # useful for mocking out in tests + + ++SIGV4_MUST_BE_SIGNED_AMZ_PREFIXES = ( ++ 'x-amz-copy', ++ 'x-amz-acl', ++ 'x-amz-grant', ++ 'x-amz-meta', ++) ++ ++ + CHECKSUMS_BY_HEADER = { + 'x-amz-checksum-crc32': checksum.crc32, + 'x-amz-checksum-crc32c': checksum.crc32c, +@@ -924,6 +932,14 @@ class SigV4Mixin(object): + (k.lower().strip(), ' '.join(_header_strip(v or '').split())) + for (k, v) in self.headers.items()) + ++ for key in headers_lower_dict: ++ key = swob.wsgi_to_str(key) ++ if (key not in self._signed_headers ++ and key.startswith(SIGV4_MUST_BE_SIGNED_AMZ_PREFIXES)): ++ raise AccessDenied( ++ 'There were headers present in the request which were ' ++ 'not signed', headers_not_signed=key) ++ + if 'host' in headers_lower_dict and re.match( + 'Boto/2.[0-9].[0-2]', + headers_lower_dict.get('user-agent', '')): +diff --git a/test/unit/common/middleware/s3api/test_s3api.py b/test/unit/common/middleware/s3api/test_s3api.py +index ad393750b..4c0026140 100644 +--- a/test/unit/common/middleware/s3api/test_s3api.py ++++ b/test/unit/common/middleware/s3api/test_s3api.py +@@ -544,6 +544,26 @@ class TestS3ApiMiddleware(S3ApiTestCase): + self.assertNotIn('Authorization', headers) + self.assertNotIn('X-Auth-Token', headers) + ++ def test_signed_url_v4_rejects_unsigned_copy_source(self): ++ amz_date = self.get_v4_amz_date_header() ++ req = Request.blank( ++ '/bucket/object?X-Amz-Algorithm=AWS4-HMAC-SHA256&' ++ 'X-Amz-Credential=test:tester/%s/us-east-1/s3/aws4_request&' ++ 'X-Amz-Date=%s&X-Amz-Expires=1000&X-Amz-SignedHeaders=host&' ++ 'X-Amz-Signature=X' % (amz_date.split('T', 1)[0], amz_date), ++ method='PUT', ++ headers={'X-Amz-Copy-Source': '/private/secret'}) ++ req.environ['headers_raw'] = list(req.headers.items()) ++ ++ status, _headers, body = self.call_s3api(req) ++ ++ self.assertEqual('403 Forbidden', status) ++ self.assertEqual('AccessDenied', self._get_error_code(body)) ++ self.assertEqual( ++ 'There were headers present in the request which were not signed', ++ self._get_error_message(body)) ++ self.assertFalse(self.swift.calls) ++ + def test_signed_urls_v4_bad_credential(self): + def test(credential, message, extra=b''): + req = Request.blank( +diff --git a/test/unit/common/middleware/s3api/test_s3request.py b/test/unit/common/middleware/s3api/test_s3request.py +index 501578771..9a3b604a6 100644 +--- a/test/unit/common/middleware/s3api/test_s3request.py ++++ b/test/unit/common/middleware/s3api/test_s3request.py +@@ -396,6 +396,43 @@ class TestRequest(S3ApiTestCase): + self.assertEqual(status.split()[0], '403') + self.assertEqual(body, b'') + ++ def _make_sigv4_req(self, extra_headers): ++ date_header = self.get_v4_amz_date_header() ++ scope_date = date_header.split('T', 1)[0] ++ headers = { ++ 'X-Amz-Date': date_header, ++ 'Authorization': ++ 'AWS4-HMAC-SHA256 ' ++ 'Credential=test/%s/us-east-1/s3/aws4_request, ' ++ 'SignedHeaders=%s,' ++ 'Signature=X' % ( ++ scope_date, ';'.join(sorted(['host', 'x-amz-date']))), ++ 'X-Amz-Content-SHA256': '0' * 64, ++ } ++ headers.update(extra_headers) ++ return Request.blank('/bucket/object', method='PUT', headers=headers) ++ ++ def test_sigv4_unsigned_sensitive_x_amz_header_is_rejected(self): ++ for header, value in ( ++ ('X-Amz-Copy-Source', '/victim/secret'), ++ ('X-Amz-Copy-Source-Range', 'bytes=0-1'), ++ ('X-Amz-Metadata-Directive', 'REPLACE'), ++ ('X-Amz-Acl', 'public-read'), ++ ('X-Amz-Grant-Read', 'id=someone'), ++ ('X-Amz-Meta-Injected', 'x')): ++ req = self._make_sigv4_req({header: value}) ++ with self.assertRaises(AccessDenied) as cm: ++ SigV4Request(req.environ, conf=self.s3api.conf) ++ self.assertEqual( ++ 'There were headers present in the request which were ' ++ 'not signed', cm.exception._msg) ++ self.assertEqual( ++ header.lower(), cm.exception.info['headers_not_signed']) ++ ++ def test_sigv4_unsigned_inert_x_amz_header_is_allowed(self): ++ req = self._make_sigv4_req({'X-Amz-Storage-Class': 'STANDARD'}) ++ SigV4Request(req.environ, conf=self.s3api.conf) ++ + def _test_request_timestamp_sigv4(self, date_header): + # signature v4 here + environ = { +-- +2.55.0 + diff -Nru swift-2.35.1/debian/patches/CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch swift-2.35.1/debian/patches/CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch --- swift-2.35.1/debian/patches/CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch 1970-01-01 00:00:00.000000000 +0000 +++ swift-2.35.1/debian/patches/CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch 2026-08-17 09:01:41.000000000 +0000 @@ -0,0 +1,69 @@ +Description: swob: avoid excessive backtracking in Accept parser + Python's regex engine uses backtracking: when a later part of a match + fails, it goes back and tries other ways of matching earlier alternatives. + . + Swift parses Accept headers on account and container requests before + authentication. A small malformed header can keep a proxy worker at + 100% CPU, with processing time growing roughly as phi^n for n consecutive + backslashes. One request per worker can make the proxy unavailable, and + disconnecting does not stop the ongoing regex evaluation. + . + In a quoted Accept parameter, backslashes could match either as normal + characters or as parts of escaped pairs. If the closing quote was missing, + Python tried every possible partition before rejecting the header. + . + Exclude backslashes from normal quoted text so they can only start an + escaped character. This removes the ambiguity and makes malformed + headers fail quickly while preserving valid escaped characters. +Author: Christian Schwede +Date: Tue, 30 Jun 2026 13:42:05 +0200 +Change-Id: I7a61b82f0e284374d7a3b5b46d6643b8a75ea89e +Assisted-by: OpenAI Codex (GPT-5) +Signed-off-by: Christian Schwede +Bug: https://launchpad.net/bugs/2158771 +Bug-Debian: https://bugs.debian.org/1142973 +Origin: upstream, https://review.opendev.org/c/openstack/swift/+/998953 +Last-Update: 2026-07-22 + +Index: swift/swift/common/swob.py +=================================================================== +--- swift.orig/swift/common/swob.py ++++ swift/swift/common/swob.py +@@ -697,7 +697,7 @@ class Accept(object): + + # RFC 2616 section 2.2 + token = r'[^()<>@,;:\"/\[\]?={}\x00-\x20\x7f]+' # nosec B105 +- qdtext = r'[^"]' ++ qdtext = r'[^"\\]' + quoted_pair = r'(?:\\.)' + quoted_string = r'"(?:' + qdtext + r'|' + quoted_pair + r')*"' + extension = (r'(?:\s*;\s*(?:' + token + r")\s*=\s*" + r'(?:' + token + +Index: swift/test/unit/common/test_swob.py +=================================================================== +--- swift.orig/test/unit/common/test_swob.py ++++ swift/test/unit/common/test_swob.py +@@ -425,6 +425,24 @@ class TestAccept(unittest.TestCase): + 'text/xml']) + self.assertEqual(match, 'application/xml') + ++ def test_accept_quoted_extension_with_escapes(self): ++ for accept in (r'text/plain;note="escaped \" quote"', ++ r'text/plain;note="escaped \\ backslash"'): ++ acc = swob.Accept(accept) ++ match = acc.best_match(['text/plain', 'application/xml']) ++ self.assertEqual(match, 'text/plain') ++ ++ def test_accept_rejects_unterminated_quoted_extension(self): ++ self.assertIsNone(re.fullmatch(swob.Accept.qdtext, '\\')) ++ ++ for accept in ( ++ 'text/plain;note="' + r'\a' * 10000, ++ r'text/plain;note="escaped \" quote', ++ r'text/plain;note="trailing \"'): ++ acc = swob.Accept(accept) ++ with self.assertRaises(ValueError): ++ acc.best_match(['text/plain', 'application/xml']) ++ + def test_accept_invalid(self): + for accept in ('*', 'text/plain,,', 'some stuff', + 'application/xml;q=1.0;q=1.1', 'text/plain,*', diff -Nru swift-2.35.1/debian/patches/series swift-2.35.1/debian/patches/series --- swift-2.35.1/debian/patches/series 2026-05-28 17:00:54.000000000 +0000 +++ swift-2.35.1/debian/patches/series 2026-08-17 09:01:41.000000000 +0000 @@ -6,3 +6,7 @@ drive-full-checker.patch bug-2119646-swift.patch CVE-2026-49017_OSSA-2026-014_s3api_Error_on+truncated+aws-chunked_input.patch +CVE-2026-50221-stable-2025.1_Block-internal-update-headers-at-the-gatekeeper.patch +CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_require_signing_of_sensitive_SigV4_x-amz_headers.patch +CVE-2026-71191_OSSA-2026-030-stable-2025.1-s3api_drop_native_Swift_control_headers_from_client_requests.patch +CVE-2026-71192_OSSA-2026-031_stable-2025.1-swob_avoid_excessive_backtracking_in_Accept_parser.patch