CVE-2022-31028

Name of the Vulnerable Software and Affected Versions MinIO versions RELEASE.2019-09-25T18-25-51Z through RELEASE.2022-06-02T02-11-04Z

Description The issue is related to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected.

Recommendations For versions RELEASE.2019-09-25T18-25-51Z through RELEASE.2022-06-02T02-11-04Z, upgrade to RELEASE.2022-06-02T02-11-04Z or later to receive a patch. As a temporary workaround, consider using a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from malicious clients.