MinIO: Security BugFix Release

Source available — automated, not human-reviewed

Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

✨ Features 3 🔧 Bug Fixes 6

⚡ Executive Summary (TL;DR)

MinIO RELEASE.2021-03-17T02-33-02Z. Source highlight: Click here to download the latest version of MinIO.

Visit MinIO Official Site ↗ Official Release Source ↗ All MinIO Releases 📡 MinIO RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

✨ New Features & Capabilities (3)

policy: Add Merge API (#11793) (03/16/21) (Anis Elleuch)
add missing principalId in web notifications (#11777) (03/13/21) (Harshavardhana)
Add consoleAdmin as a default canned policy (#11770) (03/13/21) (Nitish Tiwari)

🔧 Bug Fixes & Patches (6)

This release fixes a MITM attack in aws-chunked signature v4 encoding, for more information please read
Other miscellaneous fixes include
Fix `STANDARD` defaults, point to new docs site. (#11800) (03/16/21) (Ravind Kumar)
fix: erasure index based reading based on actual ParityBlocks (#11792) (03/15/21) (Harshavardhana)
s3 select: fix date_diff behavior (#11786) (03/15/21) (Klaus Post)
fix: runtime issue on FreeBSD due to missing O_NOATIME/O_DSYNC support (#11790) (03/15/21) (Steve Wills)

📄 View Raw Release Notes (Original Developer Log)

## Highlights - Click [here](https://min.io/download) to download the latest version of MinIO. - Click [here](https://min.io/pricing) for production support. - This release fixes a MITM attack in aws-chunked signature v4 encoding, for more information please read our security advisory [here](https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp) - Other miscellaneous fixes include - r/w failure regression on FreeBSD operating system due to unexpected file open flags. - browser now supports QR code with presigned URLs. - Support DeleteMarker disable setting in replication configuration. ## Changelog - s3v4: read and verify S3 signature v4 chunks separately (#11801) (03/16/21) (Andreas Auernhammer) - Fix `STANDARD` defaults, point to new docs site. (#11800) (03/16/21) (Ravind Kumar) - erasure pools enable faster checks for file not found (#11799) (03/16/21) (Klaus Post) - policy: Add Merge API (#11793) (03/16/21) (Anis Elleuch) - fix: erasure index based reading based on actual ParityBlocks (#11792) (03/15/21) (Harshavardhana) - s3 select: fix date_diff behavior (#11786) (03/15/21) (Klaus Post) - fix: runtime issue on FreeBSD due to missing O_NOATIME/O_DSYNC support (#11790) (03/15/21) (Steve Wills) - fix: mips 32bit compilation issue (#11775) (03/15/21) (Harshavardhana) - add missing principalId in web notifications (#11777) (03/13/21) (Harshavardhana) - Replication: Enforce DeleteMarker disable setting (#11720) (03/13/21) (Poorna Krishnamoorthy) - Add consoleAdmin as a default canned policy (#11770) (03/13/21) (Nitish Tiwari) - cmd/os-readdir_other.go - return nil with err (#11772) (03/12/21) (Philip Brown) - update browser assets for react-qr-code (03/11/21) (Harshavardhana)

← Older Version MinIO RELEASE.2021-03-12T00-00-47Z Newer Version → MinIO RELEASE.2021-03-26T00-00-41Z