High severity · published Nov 8, 2019
CVE-2019-10222
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests
7.5
CVSS
4.5%
EPSS
No
On KEV
Description
A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash the Ceph RGW server by sending valid HTTP headers and terminating the connection, resulting in a remote denial of service for Ceph RGW clients.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Ceph
All versions, or not specified · source: NVD
CS
Ceph Storage · Redhat
3.0; 3.3 · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10222
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10222
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10222
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
Vendor Advisory
https://tracker.ceph.com/issues/40018
More from Ceph
9.1
CVE-2026-50152
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
8.9
CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
8.8
CVE-2026-39944
Ceph: CephX AES Authentication error
8.1
CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
8.1
CVE-2018-10861
A flaw was found in the way ceph mon handles user requests