Is CVE-2026-39414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39414 being exploited in the wild.

How severe is CVE-2026-39414?

High severity, with a CVSS score of 6.5, published 8 April 2026.

Which products and versions are affected?

github.com/minio/minio (Go) >= 0.0.0-20180815103019-7c14cdb60e53, SEMVER:introduced=0.0.0-20180815103019-7c14cdb60e53; Minio >= RELEASE.2018-08-18T03-49-57Z, < RELEASE.2025-12-20T04-58-37Z.

Is there a fix for CVE-2026-39414?

A patch was published on 2025-12-20: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39414 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-39414?

Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39414: MinIO denial of service via memory exhaustion in S3 Select CSV parsing

Q: Is there a fix for CVE-2026-39414?

A patch was published on 2025-12-20: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39414 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-39414?

Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39414 · Severity: high · CVSS 6.5 · Published 2026-04-08

MinIO, a high-performance data storage system, is vulnerable to a denial-of-service attack that can crash the server. An authorized user can upload a specially crafted file that, when processed, consumes all available system memory, leading to a complete service outage. This can be triggered even with small uploaded files if they are compressed, potentially impacting business operations and data availability.

Technologies: github.com/minio/minio (Go), Minio. Vendors: Go, MinIO.

Quick answers

Is CVE-2026-39414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39414 being exploited in the wild.
How severe is CVE-2026-39414?: High severity, with a CVSS score of 6.5, published 8 April 2026.
Which products and versions are affected?: github.com/minio/minio (Go) >= 0.0.0-20180815103019-7c14cdb60e53, SEMVER:introduced=0.0.0-20180815103019-7c14cdb60e53; Minio >= RELEASE.2018-08-18T03-49-57Z, < RELEASE.2025-12-20T04-58-37Z.
Is there a fix for CVE-2026-39414?: A patch was published on 2025-12-20: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39414 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-39414?: Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in MinIO's S3 Select feature due to unbounded memory allocation during CSV parsing. The `nextSplit()` function in `internal/s3select/csv/reader.go` utilizes `bufio.Reader.ReadBytes('\n')` without a size limit, causing the application to buffer the entire input into a single memory allocation until a newline is encountered. An authenticated attacker with `s3:PutObject` and `s3:GetObject` permissions can exploit this by providing a CSV file lacking newlines, potentially amplified by gzip compression to exhaust gigabytes of RAM with a small payload. This results in an Out-Of-Memory (OOM) crash of the MinIO process. The issue is resolved in MinIO AIStor RELEASE.2025-12-20T04-58-37Z by implementing a 128 KB cap on line scanning.

Affected products

MinIO MinIO >= RELEASE.2018-08-18T03-49-57Z, < RELEASE.2025-12-20T04-58-37Z

Identifiers

CVE-2026-39414
GHSA-h749-fxx7-pwpg
GO-2026-5415

Timeline

2018-08-18: other: Vulnerability introduced in RELEASE.2018-08-18T03-49-57Z
2025-12-20: patched: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z
2026-04-07: advisory: Vendor advisory GHSA-h749-fxx7-pwpg published
2026-04-08: disclosed: CVE-2026-39414 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.