CVE-2024-47866: RGW DoS attack with empty HTTP header in S3 object copy

Published Sep 1, 2025
·
Updated

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument x-amz-copy-source to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.

Other sources

Ceph RGW will crash if x-amz-copy-source is used to put an empty string as the object, resulting in impact to availability.

Red Hat

RGW DoS attack with empty HTTP header in S3 object copy

Microsoft

Affected Software

5 affected componentsFixes available
ceph Ceph<=19.2.3
Microsoft cbl2 ceph 16.2.10-10
Microsoft azl3 ceph 18.2.2-11
Microsoft cbl2 ceph 16.2.10-11
redhat Ceph<=19.2.3

Event History

Sep 1, 2025
Data Sourced
via Red Hat·01:36 PM
DescriptionSeverityAffected Software
Nov 12, 2025
CVE Published
via MITRE·06:28 PM
Data Sourced
via MITRE·06:28 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 14, 2025
Data Sourced
via Microsoft·01:01 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·01:01 AM
SeverityAffected Software
Updated
via Microsoft·01:01 AM
DescriptionSeverity
Updated
via Microsoft·01:01 AM
Affected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-47866?

CVE-2024-47866 has a high severity rating as it allows for a Denial of Service attack due to the RGW daemon crashing.

2

How do I fix CVE-2024-47866?

To fix CVE-2024-47866, upgrade Ceph to version 19.2.4 or later, where the vulnerability has been addressed.

3

What versions of Ceph are affected by CVE-2024-47866?

CVE-2024-47866 affects Ceph versions up to and including 19.2.3.

4

What happens when the x-amz-copy-source argument is used with an empty string in CVE-2024-47866?

Using the x-amz-copy-source argument with an empty string in CVE-2024-47866 causes the RGW daemon to crash.

5

Is there a workaround for CVE-2024-47866?

Currently, the best approach for CVE-2024-47866 is to upgrade to a patched version, as no specific workaround is recommended.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203