EUVD-2026-20602
GHSA-h749-fxx7-pwpg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to MinIO S3 API
-
ExploitUpload CSV file without newlines
-
ExecutionTrigger S3 Select processing
-
ImpactMemory exhaustion causes OOM crash
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated user access to MinIO S3 Select feature. Attacker must upload or reference a CSV file containing lines longer than available memory with no newline characters. Affects MinIO versions RELEASE.2018-08-18T03-49-57Z through before RELEASE.2025-12-20T04-58-37Z. |
| Impact | Authenticated denial-of-service via memory exhaustion in S3 Select CSV processing. Attack requires s3:PutObject and s3:GetObject permissions; compressed payloads (~2 MB gzip) decompress to gigabytes, crashing MinIO processes with minimal upload overhead. CVSS 7.1 reflects high availability impact. Practical exploit chain and permission requirement limit blast radius to compromised or malicious authenticated users. |
| Exploit ScenarioDerived | Authenticated attacker uploads gzip-compressed CSV containing no newlines (~2 MB file decompressing to gigabytes). Attacker invokes S3 Select query on the object. MinIO's CSV reader buffers entire decompressed content into memory without limits, triggering OOM and crashing the server process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Memory exhaustion in MinIO S3 Select (RELEASE.2018-08-18T03-49-57Z through RELEASE.2025-12-20T04-58-37Z) allows authenticated users with s3:PutObject and s3:GetObject permissions to crash the server by uploading CSV files lacking newline characters. The vulnerable CSV reader buffers entire lines into memory without size limits, enabling attackers to trigger out-of-memory conditions. A ~2 MB compressed CSV can decompress to gigabytes without newlines, causing denial of service. No public exploit identified at time of analysis.
RemediationAI
Upgrade to MinIO RELEASE.2025-12-20T04-58-37Z or later, which addresses the unbounded buffer allocation in CSV processing. Upstream fix available via GitHub pull request #8200 and commit 7c14cdb60e53dbfdad2be644dfb180cab19fffa7. If immediate patching is not feasible, restrict s3:PutObject and s3:GetObject permissions to trusted users only, or disable S3 Select functionality at the server level to eliminate the attack surface. Consult vendor advisory at https://github.com/minio/minio/security/advisories/GHSA-h749-fxx7-pwpg for additional guidance. Monitor server memory utilization for abnormal spikes during CSV SELECT operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-770 uncontrolled resource consumption in nextSplit() function calling bufio.Reader.ReadBytes('\n') without bounds checking. Absence of newline delimiters forces single unbounded memory allocation of entire file contents. Compression amplification exacerbates memory pressure but is not prerequisite for exploitation. Affects cpe:2.3:a:minio:minio serving S3 Select queries.
Know when Minio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit() function calls bufio.Reader.ReadBytes('\n') with no size limit, buffering the entire input in memory until a newline is found. A CSV file with no newline characters causes the entire contents to be read into a single allocation, leading to an OOM crash of the MinIO server process. This is exploitable by any authenticated user with s3:PutObject and s3:GetObject permissions. The attack is especially practical when combined with compression: a ~2 MB gzip-compressed CSV can decompress to gigabytes of data without newlines, allowing a small upload to cause large memory consumption on the server. However, compression is not required - a sufficiently large uncompressed CSV with no newlines triggers the same issue.
Executive ViewAI
CVE-2026-39414 affects MinIO S3 Select across versions from August 2018 through December 2025, allowing authenticated users with basic object permissions to crash MinIO servers by uploading specially crafted CSV files. This vulnerability enables denial of service attacks against organizations relying on MinIO for S3-compatible object storage, potentially disrupting data access and application availability for all users of the affected deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict s3:PutObject and s3:GetObject permissions to authenticated users with explicit business need only; (2) Implement application-layer CSV validation enforcing maximum line length and decompression ratio limits before passing to S3 Select; (3) Deploy resource limits (memory caps, timeout policies) on MinIO processes; (4) Monitor MinIO memory usage and implement alerting for abnormal consumption patterns; (5) Disable S3 Select functionality if operationally feasible until patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. Rated high severity (C
MinIO is a High Performance Object Storage released under Apache License v2.0. Rated high severity (CVSS 7.7), this vuln
Minio is a Multi-Cloud Object Storage framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
MinIO is a multi-cloud object storage solution. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitab
Minio is a Multi-Cloud Object Storage framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage se
MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage se
Unauthenticated attackers can forge Embedded Console session tokens against MinIO deployments built up to RELEASE.2025-1
Authentication bypass in MinIO RELEASE.2023-05-18T00-05-36Z through RELEASE.2026-04-11T03-20-12Z allows remote unauthent
Authentication bypass in MinIO object storage allows remote attackers to write arbitrary objects to any bucket using onl
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB