CVE-2026-39414: 
MinIO vulnerability analysis and mitigation

CVE-2026-39414 is a Denial of Service vulnerability in MinIO's S3 Select feature caused by unbounded memory allocation during CSV parsing. The nextSplit() function in internal/s3select/csv/reader.go calls bufio.Reader.ReadBytes('\n') with no size limit, allowing a crafted CSV file without newline characters to exhaust server memory and crash the MinIO process. It affects all MinIO releases from RELEASE.2018-08-18T03-49-57Z up to (but not including) RELEASE.2025-12-20T04-58-37Z. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the CSV reader's nextSplit() function in internal/s3select/csv/reader.go uses bufio.Reader.ReadBytes('\n') without imposing any cap on how much data can be buffered. When a CSV file contains no newline characters, the entire file content is read into a single memory allocation, which can exhaust available RAM and trigger an OOM crash. The vulnerability was introduced in commit 7c14cdb (PR #6127, which added S3 Select CSV support) and persisted through a later refactor in PR #8200 that switched from Go's encoding/csv.Reader to bufio.Reader.ReadBytes. The attack is amplified when gzip compression is used: a ~2 MB compressed file can decompress to gigabytes of newline-free data, making the exploit highly bandwidth-efficient (GitHub Advisory, GitHub Commit).

Successful exploitation causes an out-of-memory (OOM) crash of the MinIO server process, resulting in a complete loss of availability for the object storage service. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service issue. Any authenticated user holding both s3:PutObject and s3:GetObject permissions can trigger the crash, meaning the attack surface includes all non-administrative tenant accounts in multi-user deployments (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.032%, reflecting a low probability of near-term exploitation. However, the attack is conceptually straightforward for any authenticated user and is especially practical with gzip-compressed payloads, lowering the barrier for abuse (GitHub Advisory).

1. Obtain credentials: Acquire valid MinIO credentials for an account with both s3:PutObject and s3:GetObject permissions on any accessible bucket.
2. Craft the malicious payload: Create a large CSV file containing no newline (\n) characters — either as a raw uncompressed file (sufficiently large to exhaust server RAM) or as a gzip-compressed file (~2 MB compressed, expanding to gigabytes) to maximize impact with minimal upload size.
3. Upload the object: Use the MinIO client (mc), AWS CLI, or any S3-compatible SDK to upload the crafted CSV file to a bucket the attacker has write access to (e.g., aws s3 cp malicious.csv.gz s3://target-bucket/ --endpoint-url http://<minio-host>).
4. Trigger S3 Select: Issue a SelectObjectContent (S3 Select) request against the uploaded object using a SQL expression (e.g., SELECT * FROM S3Object), specifying CSV input format. This can be done via the AWS CLI: aws s3api select-object-content --bucket target-bucket --key malicious.csv.gz --expression "SELECT * FROM S3Object" --expression-type SQL --input-serialization '{"CSV":{},"CompressionType":"GZIP"}' --output-serialization '{"CSV":{}}' output.csv.
5. OOM crash achieved: The nextSplit() function buffers the entire decompressed content into memory without limit, exhausting available RAM and crashing the MinIO server process (GitHub Advisory).

• Network: Unusual POST requests to MinIO endpoints with query parameters ?select&select-type=2, particularly from accounts not typically performing S3 Select operations; large object uploads followed immediately by SelectObjectContent requests.
• Logs: MinIO server logs showing OOM-related panics or process crashes; access logs recording SelectObjectContent API calls against recently uploaded large or compressed CSV objects; repeated S3 Select requests from the same access key in a short timeframe.
• File System: Presence of large (multi-GB) or suspiciously compressed CSV files in buckets, especially files with no newline characters.
• Process: Sudden termination of the MinIO server process (exit due to OOM kill); Linux kernel OOM killer logs (dmesg or /var/log/syslog) referencing the MinIO process being killed (GitHub Advisory).

Upgrade MinIO to RELEASE.2025-12-20T04-58-37Z (MinIO AIStor) or later, which replaces the unbounded bufio.Reader.ReadBytes('\n') call with a byte-at-a-time loop capped at 128 KB (csvSplitSize); if no newline is found within this limit, the reader returns an error rather than continuing to buffer. If immediate upgrade is not possible, apply the following workarounds: (1) Disable S3 Select access via IAM policy by denying the s3:GetObject action with conditions, or block POST requests with ?select&select-type=2 query parameters at a reverse proxy; (2) Restrict s3:PutObject grants to trusted principals only to reduce the attack surface. Note that workarounds reduce risk but do not eliminate the vulnerability (GitHub Advisory).

The vulnerability was disclosed by the MinIO maintainer harshavardhana via a GitHub Security Advisory on April 7–8, 2026, crediting XlabAITeam as the finder and klauspost and marktheunissen as remediation contributors. The minio/minio repository was subsequently archived by its owner on April 25, 2026, with users directed to migrate to MinIO AIStor. TuxCare announced an Endless Lifecycle Support offering for MinIO following the community edition archive, indicating broader ecosystem concern about the project's end-of-life status (GitHub Advisory, Feedly).