CVE-2024-47866

Name	CVE-2024-47866
Description	Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions exist.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ceph (PTS)	bullseye	14.2.21-1	vulnerable
	bullseye (security)	14.2.21-1+deb11u1	vulnerable
	bookworm, bookworm (security)	16.2.15+ds-0+deb12u1	vulnerable
	forky, sid, trixie	18.2.7+ds-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ceph	source	(unstable)	(unfixed)

Notes

https://www.openwall.com/lists/oss-security/2025/11/11/3
https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8
https://tracker.ceph.com/issues/72669
https://github.com/ceph/ceph/pull/65159
Fixed by: https://github.com/ceph/ceph/commit/bef59f17293e6e93af025eba1e00646d0b1a2bf0