MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never …

{
                    "defaultStatus": "unaffected",
                    "product": "MinIO",
                    "repo": "https://github.com/minio/minio",
                    "vendor": "MinIO",
                    "versions": [
                        {
                            "lessThanOrEqual": "7aac2a2c5b7c882e68c1ce017d8256be2feea27f",
                            "status": "affected",
                            "version": "0",
                            "versionType": "git"
                        }
                    ]
                }