diff --git a/src/api/common/xml/cors.rs b/src/api/common/xml/cors.rs
index ae1f9b72..c62a0fa3 100644
--- a/src/api/common/xml/cors.rs
+++ b/src/api/common/xml/cors.rs
@@ -13,7 +13,9 @@ use crate::common_error::{CommonError as Error, OkOrBadRequest};
 pub struct CorsConfiguration {
 	#[serde(rename = "@xmlns", serialize_with = "xmlns_tag", skip_deserializing)]
 	pub xmlns: (),
-	#[serde(rename = "CORSRule")]
+	// "default" is required to be able to parse an empty list of rules,
+	// cf https://docs.rs/quick-xml/latest/quick_xml/de/#sequences-xsall-and-xssequence-xml-schema-types
+	#[serde(rename = "CORSRule", default)]
 	pub cors_rules: Vec<CorsRule>,
 }
 
@@ -199,4 +201,22 @@ mod tests {
 
 		assert_eq!(unprettify_xml(message), unprettify_xml(&message2));
 	}
+
+	#[test]
+	fn test_deserialize_norules() {
+		let message = r#"<?xml version="1.0" encoding="UTF-8"?>
+	<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"></CORSConfiguration>"#;
+		let conf: CorsConfiguration = from_str(message).unwrap();
+		let ref_value = CorsConfiguration {
+			xmlns: (),
+			cors_rules: vec![],
+		};
+		assert_eq! {
+			ref_value,
+			conf
+		};
+
+		let message2 = to_xml_with_header(&ref_value).expect("xml serialization");
+		assert_eq!(unprettify_xml(&message), unprettify_xml(&message2));
+	}
 }