CVE-2018-1000538 Denial of service in n/a

What is CVE-2018-1000538?

CVE-2018-1000538 is a high-severity denial of service vulnerability in n/a, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-(pre)signed requests with large bodies . This vulnerability appears to have been fixed in after commit 9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7.

Weakness: CWE-774

Which versions are affected by CVE-2018-1000538?

It affects 1 product.

Products include Minio Minio.

How do I fix CVE-2018-1000538?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-1000538 being exploited?

There is no known exploitation of CVE-2018-1000538 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2023-28434 MinIO Security Feature Bypass Exploited High 8.8
• CVE-2023-28432 MinIO Information Disclosure Exploited High 7.5
• CVE-2020-11012 Authentication bypass MinIO Admin API Critical 9.3
• CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication Critical 9.2
• CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit Critical 9.1

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as MINI-h9fj-pm3v-whpp, MINI-vc98-jcw3-4wgp.