Riskcovery

CVE-2022-31028

Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

State
Published
Severity
7.5 High
Published
Jun 3, 2022
Updated
Apr 22, 2025
Reserved
May 18, 2022

Read the record on cve.org

Description

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HGitHub_M

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
miniominio
  • >= RELEASE.2019-09-25T18-25-51Z, < RELEASE.2022-06-02T02-11-04ZAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.