CVE-2021-21390

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature. This is fixed in version RELEASE.2021-03-17T02-33-02Z. As a workaround one can avoid using "aws-chunked" encoding-based chunk signature upload requests instead use TLS. MinIO SDKs automatically disable chunked encoding signature when the server endpoint is configured with TLS.

• CWE-924
• CWE-924

• https://github.com/minio/minio/commit/e197800f9055489415b53cf137e31e194aaf7ba0Exploit, Patch, Third Party Advisory
• https://github.com/minio/minio/pull/11801Exploit, Patch, Third Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgpExploit, Patch, Third Party Advisory
• https://github.com/minio/minio/commit/e197800f9055489415b53cf137e31e194aaf7ba0Exploit, Patch, Third Party Advisory
• https://github.com/minio/minio/pull/11801Exploit, Patch, Third Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgpExploit, Patch, Third Party Advisory

Published

Mar 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21384shescape is a simple shell escape package for JavaScript. In…7.8
• CVE-2021-21385Mifos-Mobile Android Application for MifosX is an Android Ap…7.4
• CVE-2021-21386APKLeaks is an open-source project for scanning APK file for…9.8
• CVE-2021-21387Wrongthink peer-to-peer, end-to-end encrypted messenger with…7.5
• CVE-2021-21388systeminformation is an open source system and OS informatio…9.8
• CVE-2021-21389BuddyPress is an open source WordPress plugin to build a com…8.8
• CVE-2021-21391CKEditor 5 provides a WYSIWYG editing solution. This CVE aff…6.5
• CVE-2021-21392Synapse is a Matrix reference homeserver written in python (…6.3
• CVE-2021-21393Synapse is a Matrix reference homeserver written in python (…6.5
• CVE-2021-21394Synapse is a Matrix reference homeserver written in python (…6.5
• CVE-2021-21395Magneto LTS (Long Term Support) is a community developed alt…4.3
• CVE-2021-21396wire-server is an open-source back end for Wire, a secure co…6.5