CVE-2025-30156

A flaw was found in the CephX authentication protocol used by Ceph, a distributed storage system. CephX uses AES-128-CBC encryption with a hardcoded initialization vector and no message authentication HMAC, making it vulnerable to the same class of unauthenticated-encryption attacks that...

Linux Distros Unpatched Vulnerability : CVE-2026-50152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ceph - None Ubuntu Linux - Unknown description CVE-2026-50152 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-54330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ceph - None Ubuntu Linux - Unknown description CVE-2026-54330 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-39944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ceph - None Ubuntu Linux - Unknown description CVE-2026-39944 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2025-30156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ceph - None Red Hat Enterprise Linux - kernel: ceph: kernel: Ceph: exploit of hardcoded IVECs, in a misuse of AES, resulting in authentication...

CVE-2026-54330

A flaw was found in Ceph RGW's SigV4 signature verification handler. When processing S3 requests, RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders field but does not reject requests that carry additional unsigned x-amz- headers. This diverges from the AWS S3 specificatio...

CVE-2026-50152

A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages. Any CephX user holding mon allow r capabilities can read the entire config-key store, which contai...

CVE-2026-39944

A flaw was found in Ceph RGW's STS Security Token Service session token implementation. The STS tokens use the same unauthenticated AES-128-CBC encryption as CephX, which lacks message authentication and uses a hardcoded initialization vector. Because there is no integrity protection on the token...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-8962: RHODF 4.20.17 release DFBUGS-8003: GSS Rook Ceph metrics are not being scraped, and the...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9558: MDR: Post-upgrade 4.21 to 4.22 DRPolicy validation failure in Metro DR DFBUGS-9404: Backport to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100726)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100726 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crushdecode A message of type CEPHMSGOSDMAP...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099788 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crushdecode A message of type CEPHMSGOSDMAP...

The vulnerability of the ceph kernel component in the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the ceph kernel component in the Linux operating system is related to improper handling of the absence of a specific element. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the osd_fault() function in the net/ceph/osd_client.c module, which is part of the Linux kernel’s networking functions, allows a hacker to trigger a service failure.

The vulnerability of the osdfault function in the net/ceph/osdclient.c module, which implements kernel networking functions in the Linux operating system, is related to state management errors. Exploiting this vulnerability could allow a remote attacker to cause service failures...

The vulnerability in the ceph/osd_client.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the ceph/osdclient.c component of the Linux operating system is related to errors during thread blocking. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-68433 libceph: bound get_version reply decode to front len

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

The vulnerability of the have_mon_and_osd_map() function in the net/ceph/ceph_common.c kernel module of the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the havemonandosdmap function in the net/ceph/cephcommon.c kernel module of the Linux operating system is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to trigger a service failure...

PT-2026-70947

In the Linux kernel, the following vulnerability has been resolved: libceph: bound get version reply decode to front len handle get version reply uses msg-front alloc len as the decode boundary for MON GET VERSION REPLY. That is the size of the reused reply buffer, not the number of bytes actuall...

CVE-2026-68160

A flaw was found in the Linux kernel's Ceph component. A remote attacker could exploit this by sending a specially crafted message with a manipulated snaptracelen value. This pre-authentication vulnerability allows for an out-of-bounds read, potentially leading to information disclosure or a deni...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...