CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

Ceph — security advisories

9 advisorieslatest 2026-08-20⚡ RSS feed

Tracked Ceph products:

⚡ Watch Ceph

Get an email when a new Ceph advisory drops — max one per day, one-click unsubscribe.

Multiple vulnerabilities in Ceph (20 August 2026)

unknownCVE-2026-39944 CVE-2026-54330 CVE-2025-30156 CVE-2026-50152cert-fr-avis2026-08-20

CVE-2026-68433: libceph: bound get_version reply decode to front len

lowCVSS 3.7CVE-2026-68433msrc2026-08-11

CVE-2026-68155: libceph: Reject monmaps advertising zero monitors

highCVSS 7.5CVE-2026-68155msrc2026-08-11

CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

mediumCVSS 6.5CVE-2026-68159msrc2026-08-11

CVE-2025-39927: ceph: fix race condition validating r_parent before applying state

mediumCVSS 6.4CVE-2025-39927msrc2026-08-06

CVE-2025-38660: [ceph] parse_longname(): strrchr() expects NUL-terminated string

highCVSS 7.1CVE-2025-38660msrc2026-08-06

CVE-2023-52732: ceph: blocklist the kclient when receiving corrupted snap trace

mediumCVSS 5.5CVE-2023-52732msrc2026-08-06

CVE-2018-1128: It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

unknownCVE-2018-1128msrc2026-08-06

CVE-2026-52961: ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

highCVSS 7.1CVE-2026-52961msrc2026-06-09