CVE-2024-47866

Description

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.13%• Percentile: 32%

Techniques & Countermeasures

• CWE-20•Improper Input Validation

  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

• ceph•ceph

  ≤ 19.2.3

• redhat•ceph

  ≤ 19.2.3

References (2)

• https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8
• http://www.openwall.com/lists/oss-security/2025/11/11/3