MinIO: Critical Security Fix Release

Source available — automated, not human-reviewed

Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

🔧 Bug Fixes 4

⚡ Executive Summary (TL;DR)

MinIO RELEASE.2018-05-04T23-13-12Z. Source highlight: If you are running RELEASE.2018–04–27T23–33–52Z, please upgrade immediately. This release fixes a Denial-of-Service (DoS) vulnerability against the Minio Server. Please refer to our blog for more details.

Visit MinIO Official Site ↗ Official Release Source ↗ All MinIO Releases 📡 MinIO RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

🔧 Bug Fixes & Patches (4)

If you are running RELEASE.2018–04–27T23–33–52Z, please upgrade immediately. This release fixes a Denial-of-Service (DoS) vulnerability against the Minio Server. Please refer to our blog for more details.
fix DoS vulnerability in request authentication (#5887) (05/04/18) <Andreas Auernhammer>
fs: fix logging by not logging common scenarios (#5882) (05/02/18) <Harshavardhana>
Fix output of AMQP example (#5867) (04/30/18) <Egor Panfilov>

📄 View Raw Release Notes (Original Developer Log)

## Highlights - If you are running RELEASE.2018–04–27T23–33–52Z, please upgrade immediately. This release fixes a Denial-of-Service (DoS) vulnerability against the Minio Server. Please refer to our [blog](https://blog.minio.io/minio-release-may-5-2018-security-advisory-ceca2850d40) for more details. ## Changelog - fix DoS vulnerability in request authentication (#5887) (05/04/18) <Andreas Auernhammer> - Use defer style to stop tickers to avoid current/possible misuse (#5883) (05/04/18) <Anis Elleuch> - Do not use crypto.SHA3_256 as placeholder for HighwayHash256 (#5847) (05/04/18) <Krishna Srinivas> - fs: fix logging by not logging common scenarios (#5882) (05/02/18) <Harshavardhana> - Return NoSuchKey for anonReqs with s3:ListBucket policy (#5876) (05/01/18) <Krishna Srinivas> - Remove s3:ListObjects policy action to be in sync with AWS-S3 (#5875) (05/01/18) <Krishna Srinivas> - Copy an object without user-defined metadata for Azure gateway (#5872) (05/02/18) <wd256> - vendor x/sys/cpu and update x/crypto/blake2b (#5870) (05/01/18) <Andreas Auernhammer> - Heal only when atleast one of the disk is unformatted (#5866) (04/30/18) <Harshavardhana> - Increased MaxIdleConnsPerHost to prevent excessive re-connections and TIME_WAIT when more than 100 clients are using minio (#5860) (04/30/18) <cbenien> - Fix output of AMQP example (#5867) (04/30/18) <Egor Panfilov>

← Older Version MinIO RELEASE.2018-04-27T23-33-52Z Newer Version → MinIO RELEASE.2018-05-10T00-00-42Z