CVE-2024-47866

Description

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

PUBLISHED Reserved 2024-10-04 | Published 2025-11-12 | Updated 2025-12-11 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

References

www.openwall.com/lists/oss-security/2025/11/11/3

github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8 exploit

github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8

cve.org (CVE-2024-47866)

nvd.nist.gov (CVE-2024-47866)

Download JSON