CVE-2024-47866

Published: Nov 12, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

Affected (1)

Products: Redhat: Ceph

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Ceph	Up to 19.2.3

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8

Source: security-advisories@github.com

ExploitVendor Advisory

http://www.openwall.com/lists/oss-security/2025/11/11/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.