# CVE-2026-39414: MinIO denial of service via memory exhaustion in S3 Select CSV parsing

Source: https://junglewise.ai/threats/cve-2026-39414-minio-denial-of-service-via-memory-exhaustion-in-s3-select-csv  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39414 · Severity: high · CVSS 6.5 · Published 2026-04-08

MinIO, a high-performance data storage system, is vulnerable to a denial-of-service attack that can crash the server. An authorized user can upload a specially crafted file that, when processed, consumes all available system memory, leading to a complete service outage. This can be triggered even with small uploaded files if they are compressed, potentially impacting business operations and data availability.

Technologies: [github.com/minio/minio (Go)](https://junglewise.ai/threats/technologies/github-com-minio-minio), [Minio](https://junglewise.ai/threats/technologies/minio). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [MinIO](https://junglewise.ai/threats/vendors/minio).

## Quick answers

**Is CVE-2026-39414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39414 being exploited in the wild.

**How severe is CVE-2026-39414?** High severity, with a CVSS score of 6.5, published 8 April 2026.

**Which products and versions are affected?** github.com/minio/minio (Go) >= 0.0.0-20180815103019-7c14cdb60e53, SEMVER:introduced=0.0.0-20180815103019-7c14cdb60e53; Minio >= RELEASE.2018-08-18T03-49-57Z, < RELEASE.2025-12-20T04-58-37Z.

**Is there a fix for CVE-2026-39414?** A patch was published on 2025-12-20: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39414 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-39414?** Check whether you run github.com/minio/minio (Go) or Minio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in MinIO's S3 Select feature due to unbounded memory allocation during CSV parsing. The `nextSplit()` function in `internal/s3select/csv/reader.go` utilizes `bufio.Reader.ReadBytes('\n')` without a size limit, causing the application to buffer the entire input into a single memory allocation until a newline is encountered. An authenticated attacker with `s3:PutObject` and `s3:GetObject` permissions can exploit this by providing a CSV file lacking newlines, potentially amplified by gzip compression to exhaust gigabytes of RAM with a small payload. This results in an Out-Of-Memory (OOM) crash of the MinIO process. The issue is resolved in MinIO AIStor RELEASE.2025-12-20T04-58-37Z by implementing a 128 KB cap on line scanning.

## Affected products

- MinIO MinIO >= RELEASE.2018-08-18T03-49-57Z, < RELEASE.2025-12-20T04-58-37Z

## Identifiers

- CVE-2026-39414
- GHSA-h749-fxx7-pwpg
- GO-2026-5415

## Timeline

- 2018-08-18: other: Vulnerability introduced in RELEASE.2018-08-18T03-49-57Z
- 2025-12-20: patched: Fixed in MinIO AIStor RELEASE.2025-12-20T04-58-37Z
- 2026-04-07: advisory: Vendor advisory GHSA-h749-fxx7-pwpg published
- 2026-04-08: disclosed: CVE-2026-39414 published

## References

- [https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition](https://docs.min.io/enterprise/aistor-object-store/upgrade-aistor-server/community-edition)
- [https://github.com/minio/minio/commit/7c14cdb60e53dbfdad2be644dfb180cab19fffa7](https://github.com/minio/minio/commit/7c14cdb60e53dbfdad2be644dfb180cab19fffa7)
- [https://github.com/minio/minio/pull/8200](https://github.com/minio/minio/pull/8200)
- [https://github.com/minio/minio/security/advisories/GHSA-h749-fxx7-pwpg](https://github.com/minio/minio/security/advisories/GHSA-h749-fxx7-pwpg)

## Related threats

- [MinIO Signature V4 verification improper signature validation](https://junglewise.ai/threats/cve-2026-122267-minio-signature-v4-verification-before-release-2026-09-22t19-25)
- [MinIO Embedded Console hard-coded cryptographic key authentication bypass](https://junglewise.ai/threats/cve-2026-113466-a-security-vulnerability-has-been-detected-in-minio-up-to)
- [MinIO signature verification bypass in SigV4 header validation](https://junglewise.ai/threats/cve-2026-97731-minio-through-7aac2a2-does-not-verify-that-every-x-amz-header)
- [MinIO path traversal in ReadMultiple storage-REST endpoint](https://junglewise.ai/threats/cve-2026-42600-minio-path-traversal-in-readmultiple-storage-rest-endpoint)
- [MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads](https://junglewise.ai/threats/cve-2026-41145-minio-has-an-unauthenticated-object-write-via-query-string)