{"action":"Upgrade swift to 2.37.1-5 or later.","affected":[{"fixed":"2.37.1-5","introduced":"0"}],"component":"swift","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.37.1-5"],"id":"tcs_01M5NSPGSVZTKA3EHZTM3Z1YGY","modified_at":"2026-10-01T03:03:25.107952031Z","published_at":"2026-06-23T18:18:04.440Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-50221","https://security-tracker.debian.org/tracker/CVE-2026-50221"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-50221#Debian:14/swift","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-50221"}],"summary":"In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwardin"}