{"action":"Upgrade swift to 2.35.1-0+deb13u3 or later.","affected":[{"fixed":"2.35.1-0+deb13u3","introduced":"0"}],"component":"swift","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.35.1-0+deb13u3"],"id":"tcs_01M5NSPGPK7PNEAD01HX8KVQ5K","modified_at":"2026-10-26T11:47:33.643990195Z","published_at":"2026-06-23T18:18:04.440Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-50221","https://security-tracker.debian.org/tracker/CVE-2026-50221"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-50221#Debian:13/swift","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-50221"}],"summary":"In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwardin"}