TI-2024-32120 Aliases CVE-2024-47866

RGW DoS attack with empty HTTP header in S3 object copy

HIGH 66CWE-20Published 2025-11-12 · Updated 2025-12-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 5 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00479 41st percentileScored 2026-11-08

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 5 advisoriesRed Hat: 5 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ceph	ceph	up to 19.2.3	—	No fix listed	CNA

ceph Vendorceph Affected up to 19.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:ceph::::::::	up to 19.2.3	Vulnerable	Red Hat

cpe:2.3:a:redhat:ceph:*:*:*:*:*:*:*:* Versions up to 19.2.3 Vulnerable ·Red Hat

Remediation

Red Hat 5 advisories

RHSA-2026:86618 Released 2026-10-21 · Red Hat rating Critical
New container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
RHSA-2026:83548 Released 2026-10-15 · Red Hat rating Important
Red Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
RHSA-2026:2769 Released 2026-02-17 · Red Hat rating Important
Red Hat Ceph Storage 7.1 security and bug fix updates
- Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-381.el8cp, ceph-2:18.2.1-381.el9cp, ceph-base-2:18.2.1-381.el8cp +47

Show 2 more Red Hat advisories

RHSA-2025:21203 Released 2025-11-12 · Red Hat rating Important
Red Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
RHSA-2025:21068 Released 2025-11-12 · Red Hat rating Important
Red Hat Ceph Storage 8.1 bug fix update
- Red Hat Ceph Storage 8.1 Tools ceph-2:19.2.1-292.el9cp, ceph-base-2:19.2.1-292.el9cp, ceph-common-2:19.2.1-292.el9cp +25

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Ceph Storage 4	Affected	No fix planned: Out of support scope
Red Hat Ceph Storage 5	Affected	No fix planned: Out of support scope
Red Hat Ceph Storage 6	Affected	No fix planned: Will not fix
Red Hat Ceph Storage 9	Affected	No fix yet
Red Hat Ceph Storage 7.1	Fixed	RHSA-2026:83548
Red Hat Ceph Storage 7.1 Tools	Fixed	RHSA-2026:2769
Red Hat Ceph Storage 8	Fixed	RHSA-2025:21203
Red Hat Ceph Storage 8.1 Tools	Fixed	RHSA-2025:21068
Red Hat Ceph Storage 9.2	Fixed	RHSA-2026:86618

Not affected: 3 products

Red Hat Ceph Storage 7.1
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9.2

Timeline

2026-10-02 Threatist record created from CVE-2024-47866
2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat

References

Exploit 1

https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8

TI-2024-32613 Ceph is vulnerable to authentication bypass through RadosGW CVSS 3.1HIGH 8.1
TI-2026-36920 Improper authorization in ceph CVSS 3.1CRITICAL 9.1
TI-2020-01660 Hard-coded credentials in ceph-ansible CVSS 3.1HIGH 8.8
TI-2018-07675 Improper authorization in Red Hat ceph CVSS 3.0HIGH 8.1
TI-2026-28807 Ceph: CephX AES Authentication error CVSS 3.1HIGH 8.8
TI-2019-07542 Improper handling of exceptional conditions in ceph CVSS 3.1HIGH 7.5

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences