Which versions of Minio are affected by CVE-2026-39414?

CVE-2026-39414 affects MinIO S3 Select across versions from August 2018 through December 2025, allowing authenticated users with basic object permissions to crash MinIO servers by uploading specially…

How to fix or mitigate CVE-2026-39414?

Within 24 hours: Identify all MinIO deployments running versions RELEASE.2018-08-18T03-49-57Z through RELEASE.2025-12-20T04-58-37Z and document current deployment versions. Within 7 days: Implement input validation on S3 Select CSV uploads (enforce maximum line lengths and file decompression ratios) and restrict s3:PutObject and s3:GetObject permissions to trusted principals only. Within 30 days: Monitor vendor security advisories for patch release and test upgrade to patched version when available; establish a process to validate CSV uploads before S3 Select processing.

Minio CVE-2026-39414

Q: What is the CVSS score of CVE-2026-39414?

CVE-2026-39414 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20602 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-08 GitHub_M

GHSA-h749-fxx7-pwpg

Denial Of Service Minio

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 20:46 euvd

EUVD-2026-20602

Analysis Generated

Apr 08, 2026 - 20:46 vuln.today

CVE Published

Apr 08, 2026 - 20:05 nvd

HIGH 7.1

DescriptionGitHub Advisory

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit() function calls bufio.Reader.ReadBytes('\n') with no size limit, buffering the entire input in memory until a newline is found. A CSV file with no newline characters causes the entire contents to be read into a single allocation, leading to an OOM crash of the MinIO server process. This is exploitable by any authenticated user with s3:PutObject and s3:GetObject permissions. The attack is especially practical when combined with compression: a ~2 MB gzip-compressed CSV can decompress to gigabytes of data without newlines, allowing a small upload to cause large memory consumption on the server. However, compression is not required - a sufficiently large uncompressed CSV with no newlines triggers the same issue.

AnalysisAI

Memory exhaustion in MinIO S3 Select (RELEASE.2018-08-18T03-49-57Z through RELEASE.2025-12-20T04-58-37Z) allows authenticated users with s3:PutObject and s3:GetObject permissions to crash the server by uploading CSV files lacking newline characters. The vulnerable CSV reader buffers entire lines into memory without size limits, enabling attackers to trigger out-of-memory conditions. A ~2 MB compressed CSV can decompress to gigabytes without newlines, causing denial of service. No public exploit identified at time of analysis.

Technical ContextAI

CWE-770 uncontrolled resource consumption in nextSplit() function calling bufio.Reader.ReadBytes('\n') without bounds checking. Absence of newline delimiters forces single unbounded memory allocation of entire file contents. Compression amplification exacerbates memory pressure but is not prerequisite for exploitation. Affects cpe:2.3:a:minio:minio serving S3 Select queries.

RemediationAI

Upgrade to MinIO RELEASE.2025-12-20T04-58-37Z or later, which addresses the unbounded buffer allocation in CSV processing. Upstream fix available via GitHub pull request #8200 and commit 7c14cdb60e53dbfdad2be644dfb180cab19fffa7. If immediate patching is not feasible, restrict s3:PutObject and s3:GetObject permissions to trusted users only, or disable S3 Select functionality at the server level to eliminate the attack surface. Consult vendor advisory at https://github.com/minio/minio/security/advisories/GHSA-h749-fxx7-pwpg for additional guidance. Monitor server memory utilization for abnormal spikes during CSV SELECT operations.