CVE-2024-47866 RGW DoS attack with empty HTTP header in S3 object copy
An attacker can crash the Ceph RGW daemon by sending an S3 copy request with an empty source header, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47866?
CVE-2024-47866 is a high-severity denial of service vulnerability in ceph, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.
Weakness: CWE-20
Which versions are affected by CVE-2024-47866?
1 open source package ship an affected version, including ceph. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ceph Bitnami | All versions | 20.2.1 |
Products include Redhat Ceph.
How do I fix CVE-2024-47866?
Upgrade ceph to 20.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-47866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47866 exists.
Other vulnerabilities in ceph
Sources
Also known as AZL-70058, AZL-70193, BIT-ceph-2024-47866, DEBIAN-CVE-2024-47866, ECHO-e246-a757-a138, GHSA-mgrm-g92q-f8h8 and 5 more.