CVE-2026-39414
Memory Exhaustion in MinIO S3 Select via Malicious CSV Files
Publication date: 2026-04-08
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| minio | minio | From 2018-08-18t03-49-57z (inc) to 2025-10-15t17-29-55z (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects MinIO's S3 Select feature when processing CSV files that contain lines longer than the available memory. The CSV reader function nextSplit() uses bufio.Reader.ReadBytes('\n') without any size limit, which causes it to buffer the entire input in memory until a newline character is found.
If a CSV file has no newline characters, the entire file content is read into a single memory allocation, leading to an out-of-memory (OOM) crash of the MinIO server process.
An attacker who is an authenticated user with s3:PutObject and s3:GetObject permissions can exploit this by uploading specially crafted CSV files. The attack is more effective when the CSV file is compressed (e.g., gzip), as a small compressed file can decompress into gigabytes of data without newlines, causing large memory consumption on the server.
How can this vulnerability impact me? :
This vulnerability can cause the MinIO server to crash due to memory exhaustion when processing maliciously crafted CSV files without newline characters.
Such crashes can lead to denial of service (DoS), disrupting access to stored data and impacting availability.
Since exploitation requires authenticated user permissions (s3:PutObject and s3:GetObject), an attacker with these permissions can intentionally cause service interruptions.