CVE-2026-39414: MinIO S3 Select DoS Vulnerability

CVE-2026-39414 Overview

MinIO, a high-performance object storage system, contains a memory exhaustion vulnerability in its S3 Select feature when processing CSV files. The vulnerability exists in versions from RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z. The CSV reader's nextSplit() function calls bufio.Reader.ReadBytes('\n') with no size limit, buffering the entire input in memory until a newline is found. A CSV file with no newline characters causes the entire contents to be read into a single allocation, leading to an OOM (Out of Memory) crash of the MinIO server process.

Critical Impact

This vulnerability allows authenticated users with s3:PutObject and s3:GetObject permissions to crash the MinIO server by uploading specially crafted CSV files, causing complete service denial. The attack is amplified when combined with compression—a ~2 MB gzip-compressed CSV can decompress to gigabytes of data without newlines.

Affected Products

• MinIO RELEASE.2018-08-18T03-49-57Z through versions before RELEASE.2025-12-20T04-58-37Z
• MinIO S3 Select feature implementations processing CSV files
• MinIO deployments with authenticated user access to object storage operations

Discovery Timeline

• April 8, 2026 - CVE-2026-39414 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-39414

Vulnerability Analysis

This memory exhaustion vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) resides in MinIO's S3 Select CSV processing functionality. The core issue stems from the CSV reader's nextSplit() function implementation, which calls Go's bufio.Reader.ReadBytes('\n') method without enforcing any size constraints on the input data.

When processing CSV files, the function continues to buffer data in memory until it encounters a newline character (\n). If an attacker provides a maliciously crafted CSV file that contains no newline characters, the entire file content is loaded into a single memory allocation. This unbounded memory allocation eventually exhausts available server memory, triggering an Out-of-Memory (OOM) condition that crashes the MinIO server process.

The attack surface is particularly concerning because it affects any authenticated user possessing s3:PutObject and s3:GetObject permissions—standard permissions commonly granted to legitimate storage users. This makes the vulnerability exploitable by low-privileged authenticated users rather than requiring administrative access.

Root Cause

The root cause lies in the absence of input size validation in the CSV parsing logic. The bufio.Reader.ReadBytes('\n') function is designed to read data until it finds the specified delimiter (newline), but it has no built-in mechanism to limit how much data it buffers. The MinIO implementation failed to wrap this call with size constraints, allowing arbitrarily large allocations based on attacker-controlled input.

Attack Vector

The attack is network-accessible and requires low privileges (authenticated user access). An attacker can exploit this vulnerability through the following approach:

1. Direct Attack: Upload a large CSV file containing no newline characters to trigger memory exhaustion
2. Compression Amplification: Upload a small (~2 MB) gzip-compressed CSV that decompresses to gigabytes of data without newlines, allowing minimal upload bandwidth to cause maximum memory consumption

The compression technique is especially practical for attackers with limited bandwidth, as it enables asymmetric resource consumption—the server must allocate memory proportional to the decompressed size, not the uploaded size.

// Security patch in cmd/api-datatypes.go - S3 Select API Support for CSV (#6127)
	responseRequestIDKey = "x-amz-request-id"
 )
 
+// CSVFileHeaderInfo -Can be either USE IGNORE OR NONE, defines what to do with
+// the first row
+type CSVFileHeaderInfo string
+
+// Constants for file header info.
+const (
+	CSVFileHeaderInfoNone   CSVFileHeaderInfo = "NONE"
+	CSVFileHeaderInfoIgnore                   = "IGNORE"
+	CSVFileHeaderInfoUse                      = "USE"
+)
+
+// SelectCompressionType - ONLY GZIP is supported
+type SelectCompressionType string
+
+// Constants for compression types under select API.
+const (
+	SelectCompressionNONE SelectCompressionType = "NONE"
+	SelectCompressionGZIP                       = "GZIP"
+	SelectCompressionBZIP                       = "BZIP2"
+)
+
+// CSVQuoteFields - Can be either Always or AsNeeded
+type CSVQuoteFields string
+
+// Constants for csv quote styles.
+const (
+	CSVQuoteFieldsAlways   CSVQuoteFields = "Always"

Source: MinIO Commit Update

Detection Methods for CVE-2026-39414

Indicators of Compromise

• Sudden memory spikes on MinIO server processes during S3 Select operations
• OOM killer events in system logs (/var/log/kern.log or dmesg) terminating MinIO processes
• Unusual uploads of large CSV files or compressed files followed by S3 Select queries
• MinIO server crashes without clear application-level error messages

Detection Strategies

• Monitor MinIO process memory consumption for abnormal growth patterns during CSV processing
• Implement alerting on s3:GetObject requests with S3 Select queries targeting recently uploaded CSV files
• Log and analyze SelectObjectContent API calls, particularly those targeting compressed objects
• Deploy kernel-level monitoring for OOM events specifically affecting MinIO processes

Monitoring Recommendations

• Configure memory usage thresholds and alerts for MinIO server processes
• Enable detailed access logging to track S3 Select operations and correlate with memory events
• Monitor decompression ratios for uploaded gzip/bzip2 files to detect amplification attacks
• Implement rate limiting on S3 Select operations per authenticated user

How to Mitigate CVE-2026-39414

Immediate Actions Required

• Upgrade MinIO to RELEASE.2025-12-20T04-58-37Z or later immediately
• Review and restrict s3:PutObject and s3:GetObject permissions to essential users only
• Implement network-level rate limiting on S3 Select API endpoints
• Configure resource limits (memory cgroups) for MinIO server processes as a defense-in-depth measure

Patch Information

MinIO has released a security patch addressing this vulnerability. The fix is available in RELEASE.2025-12-20T04-58-37Z and all subsequent releases. Administrators should upgrade by following the official MinIO Upgrade Guide. The specific code changes can be reviewed in the MinIO Pull Request and the MinIO Commit Update. Additional details are available in the GitHub Security Advisory.

Workarounds

• Disable S3 Select functionality entirely if not required for business operations
• Implement IAM policies to restrict S3 Select permissions to trusted service accounts
• Deploy a reverse proxy with request body size limits for S3 Select operations
• Configure container/process memory limits to prevent OOM from affecting the entire host

# Configuration example - Set memory limits for MinIO container
# Docker deployment with memory constraints
docker run -d \
  --name minio \
  --memory="8g" \
  --memory-swap="8g" \
  -p 9000:9000 \
  -p 9001:9001 \
  minio/minio:RELEASE.2025-12-20T04-58-37Z server /data