Is MinIO RELEASE.2025-01-20T14-49-07Z affected?

CVSS 9.2

13 known vulnerabilities affect RELEASE.2025-01-20T14-49-07Z (highest CVSS 9.2).

14 newer releases in its track, up to RELEASE.2025-10-15T17-29-55Z. What changed up to RELEASE.2025-10-15T17-29-55Z

Vulnerabilities affecting RELEASE.2025-01-20T14-49-07Z

9.2
CVE-2026-33322 JWT Algorithm Confusion in OIDC Authentication
9.1
CVE-2026-33419 LDAP login brute-force via user enumeration and missing rate limit fixed in RELEASE.2026-03-17T21-25-16Z
8.8
CVE-2026-41145 Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads
8.8
CVE-2026-40344 Unauthenticated Object Write via Missing Signature Verification in Snowball Auto-Extract
7.1
CVE-2026-39414 DoS via Unbounded Memory Allocation in S3 Select CSV Parsing
7.1
CVE-2026-34204 SSE Metadata Injection via Replication Headers
6.9
CVE-2026-42600 Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint
medium
CVE-2023-27589 Denial of access by an admin privileged user for root credential
high
CVE-2023-25812 Privilege escalation allowing DELETE on resources on object locked buckets under Governance mode
high
CVE-2022-35919 Authenticated requests for server update admin API allows path traversal
high
CVE-2022-31028 Possible DDOS by establishing keep-alive connections with anonymous HTTP clients
high
CVE-2022-24842 Unprivileged user is able to create service accounts for root or other admin users
medium
CVE-2021-21287 MinIO Browser API SSRF vulnerability