Executive brief
MinIO, a high-performance data storage system, is vulnerable to a denial-of-service attack that can crash the server. An authorized user can upload a specially crafted file that, when processed, consumes all available system memory, leading to a complete service outage. This can be triggered even with small uploaded files if they are compressed, potentially impacting business operations and data availability.
Technical details
A vulnerability exists in MinIO's S3 Select feature due to unbounded memory allocation during CSV parsing. The `nextSplit()` function in `internal/s3select/csv/reader.go` utilizes `bufio.Reader.ReadBytes('\n')` without a size limit, causing the application to buffer the entire input into a single memory allocation until a newline is encountered. An authenticated attacker with `s3:PutObject` and `s3:GetObject` permissions can exploit this by providing a CSV file lacking newlines, potentially amplified by gzip compression to exhaust gigabytes of RAM with a small payload. This results in an Out-Of-Memory (OOM) crash of the MinIO process. The issue is resolved in MinIO AIStor RELEASE.2025-12-20T04-58-37Z by implementing a 128 KB cap on line scanning.
Affected products
- MinIO MinIO >= RELEASE.2018-08-18T03-49-57Z, < RELEASE.2025-12-20T04-58-37Z
Timeline
- 2018-08-18: other: Vulnerability introduced in RELEASE.2018-08-18T03-49-57Z
- 2025-12-20: patched: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z
- 2026-04-07: advisory: Vendor advisory GHSA-h749-fxx7-pwpg published
- 2026-04-08: disclosed: CVE-2026-39414 published