TI-2018-15936 Aliases CVE-2018-1000538

TI-2018-15936

LOW 36CWE-774Published 2018-06-26 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-(pre)signed requests with large bodies . This vulnerability appears to have been fixed in after commit 9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7.

Why it matters now

EPSS 0.01485 74th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:minio:minio::::::::	before 2018-05-16t23-35-33z	Vulnerable	MinIO

cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:* Versions before 2018-05-16t23-35-33z Vulnerable ·MinIO

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-1000538

References

Patch 1

https://github.com/minio/minio/commit/9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7#diff-e8c3bc9bc83b5516d0cc806cd461d08bL220

Advisory 1

https://github.com/minio/minio/pull/5957

TI-2023-12978 MinIO is vulnerable to privilege escalation on Linux/MacOS KEVCVSS 3.1HIGH 8.8
TI-2023-12976 Minio Information Disclosure in Cluster Deployment KEVCVSS 3.1HIGH 7.5
TI-2023-11082 Allowed DELETE on resources on object locked buckets under Governance mode in Minio CVSS 3.1HIGH 8.8
TI-2024-16264 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation CVSS 3.1HIGH 8.8
TI-2022-08654 Improper Privilege Management in MinIO CVSS 3.1HIGH 8.8
TI-2022-13073 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO CVSS 3.1HIGH 7.5

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences