How severe is CVE-2022-3854?

CVE-2022-3854 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2022-3854 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-3854?

CVE-2022-3854 primarily affects Redhat Ceph Storage. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-3854?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-3854 published?

CVE-2022-3854 was published on 2023-03-06 and last updated on 2026-06-17.

CVE-2022-3854

CVE-2022-3854 is a medium-severity vulnerability in Redhat Ceph Storage with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-177.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-177
Affected product: Redhat Ceph Storage
Published: 2023-03-06
Last modified: 2026-06-17

Description

A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.

Frequently asked questions

What is CVE-2022-3854?: A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
How severe is CVE-2022-3854?: CVE-2022-3854 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2022-3854 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-3854?: CVE-2022-3854 primarily affects Redhat Ceph Storage. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-3854?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-3854 published?: CVE-2022-3854 was published on 2023-03-06 and last updated on 2026-06-17.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2139925

Affected products (3)

cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*

More vulnerabilities in Redhat Ceph Storage

CVE-2022-26148 — Critical (CVSS 9.8): An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the…
CVE-2021-20236 — Critical (CVSS 9.8): A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack…
CVE-2018-14649 — Critical (CVSS 9.8): It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug…
CVE-2018-15727 — Critical (CVSS 9.8): Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can…
CVE-2022-0670 — Critical (CVSS 9.1): A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any…
CVE-2021-4048 — Critical (CVSS 9.1): An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version…

All CVEs affecting Redhat Ceph Storage →

Other CWE-177 vulnerabilities

CVE-2026-22037 — High (CVSS 8.4): The @fastify/express plugin adds full Express compatibility to Fastify. A security vulnerability exists in…
CVE-2026-22031 — High (CVSS 8.4): @fastify/middie is the plugin that adds middleware support on steroids to Fastify. A security vulnerability exists in…
CVE-2026-29045 — High (CVSS 7.5): Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when…
CVE-2026-6414 — Medium (CVSS 5.9): @fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution,…
CVE-2024-48866 — Medium (CVSS 5.3): An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating…
CVE-2018-3718 — Medium (CVSS 5.3): serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is…

Browse all CWE-177 vulnerabilities →