High severity · published Nov 12, 2025
CVE-2024-47866
RGW DoS attack with empty HTTP header in S3 object copy
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
ceph · ceph
<= 19.2.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47866
Exploit
https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8
Mailing List
http://www.openwall.com/lists/oss-security/2025/11/11/3
More from ceph
9.1
CVE-2026-50152
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
8.9
CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
8.8
CVE-2026-39944
Ceph: CephX AES Authentication error
8.1
CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
8.1
CVE-2024-48916
Ceph is vulnerable to authentication bypass through RadosGW