This document is for a development version of Ceph.

CVE-2021-3524: HTTP header injects via CORS in RGW

A flaw was found in the radosgw. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The r character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the CORS request is made.

Fixed versions

  • Pacific v16.2.4 (and later)

  • Octopus v15.2.12 (and later)

  • Nautilus v14.2.21 (and later)


All users of Ceph object storage (RGW) should upgrade.


Red Hat would like to thank Sergey Bobrov (Kaspersky) for reporting this issue.