CVE-2022-31028

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.

• CWE-400
• CWE-400

• https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1Exploit, Third Party Advisory
• https://github.com/minio/minio/pull/14995Patch, Third Party Advisory
• https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53ZThird Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636Third Party Advisory
• https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1Exploit, Third Party Advisory
• https://github.com/minio/minio/pull/14995Patch, Third Party Advisory
• https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53ZThird Party Advisory
• https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636Third Party Advisory

Published

Jun 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31022Bleve is a text indexing library for go. Bleve includes HTTP…5.5
• CVE-2022-31023Play Framework is a web framework for Java and Scala. Verion…7.5
• CVE-2022-31024richdocuments is the repository for NextCloud Collabra, the …6.5
• CVE-2022-31025Discourse is an open source platform for community discussio…5.3
• CVE-2022-31026Trilogy is a client library for MySQL. When authenticating, …7.5
• CVE-2022-31027OAuthenticator is an OAuth token library for the JupyerHub l…6.5
• CVE-2022-31029AdminLTE is a Pi-hole Dashboard for stats and configuration.…4.8
• CVE-2022-3103off-by-one in io_uring module.7.8
• CVE-2022-31030containerd is an open source container runtime. A bug was fo…5.5
• CVE-2022-31031PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-31032Tuleap is a Free & Open Source Suite to improve management o…4.3
• CVE-2022-31033The Mechanize library is used for automating interaction wit…7.5