Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Minio Operator may misinterpret certain domain names

published 1 month ago
Summary

The Minio Operator software can incorrectly handle specially encoded domain names, treating them as normal text. This could allow unexpected behavior when those names are used. Update the Minio Operator to the latest version to fix the handling of these domain names.

What to do
  • Update cleanstart minio-operator to version 7.1.1-r5.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart minio-operator < 7.1.1-r5
Fix: upgrade to 7.1.1-r5
Original advisory text
ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the minio-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published10 Sep 2026
Updated10 Sep 2026
First seen10 Sep 2026
Sources
CLEANSTART-2026-RC17482 · OSV
Track software like this
Free during beta