CVE-2022-31028: Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

Modified

Published 03-06-2022Last modified 22-04-2025

Vulnerability summary

CVE-2022-31028 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in minio. EPSS estimates a 3.00% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

41/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

3.00%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

03-06-2022
PublishedVulnerability first disclosed.
22-04-2025
Last modifiedVulnerability information updated.

Description

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

3.00%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.00% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
2D00E6F909054D2D2524C71485Ad02E1
Maturity: poc

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Minio1 product

minio≥ RELEASE.2019-09-25T18-25-51Z, < RELEASE.2022-06-02T02-11-04Z | ≥ 2019-09-25t18-25-51z, < 2022-06-02t02-11-04z

1 vendor · 1 product

References

4 links

github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636X Refsource CONFIRMThird Party Advisory
github.com/minio/minio/pull/14995X Refsource MISCPatchThird Party Advisory
gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1X Refsource MISCExploitThird Party Advisory
github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53ZX Refsource MISCThird Party Advisory