Ceph RADOS Gateway (RGW, Beast frontend): An unauthenticated client can crash radosgw by sending valid headers followed

Impact

An unauthenticated client can crash radosgw by sending valid headers followed by an abrupt termination. Repeating it keeps the S3 endpoint down, which stalls every dataset loader and checkpoint writer that goes through object storage.

Who can reach it

Any host that can open a TCP connection to the RGW port. No credentials required, so a single tenant container with egress to the gateway is enough.

What to do

Upgrade RGW to a release with the Beast frontend fix and restart radosgw. Run multiple gateways behind a load balancer with aggressive health checking and per-source connection rate limits.

References