CVE-2026-39414 MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

What is CVE-2026-39414?

CVE-2026-39414 is a high-severity denial of service vulnerability in minio, published on 8 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

MinIO is a high-performance object storage system. From RELEASE.2018-08-18T03-49-57Z to before RELEASE.2025-12-20T04-58-37Z, MinIO's S3 Select feature is vulnerable to memory exhaustion when processing CSV files containing lines longer than available memory. The CSV reader's nextSplit() function calls bufio.Reader.ReadBytes('\n') with no size limit, buffering the entire input in memory until a newline is found. A CSV file with no newline characters causes the entire contents to be read into a single allocation, leading to an OOM crash of the MinIO server process. This is exploitable by any authenticated user with s3:PutObject and s3:GetObject permissions. The attack is especially practical when combined with compression: a ~2 MB gzip-compressed CSV can decompress to gigabytes of data without newlines, allowing a small upload to cause large memory consumption on the server. However, compression is not required — a sufficiently large uncompressed CSV with no newlines triggers the same issue.

Weakness: CWE-770

Which versions are affected by CVE-2026-39414?

3 open source packages ship an affected version, including github.com/minio/minio. It affects 1 product.

Products include Minio Minio.

How do I fix CVE-2026-39414?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-39414 being exploited?

There is no known exploitation of CVE-2026-39414 in the wild and no public exploit code.

Other vulnerabilities in minio

• CVE-2023-28434 MinIO Security Feature Bypass Exploited High 8.8
• CVE-2023-28432 MinIO Information Disclosure Exploited High 7.5
• CVE-2020-11012 Authentication bypass MinIO Admin API Critical 9.3
• CVE-2026-33322 MinIO: JWT Algorithm Confusion in OIDC Authentication Critical 9.2
• CVE-2026-33419 MinIO: LDAP login brute-force via user enumeration and missing rate limit Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h749-fxx7-pwpg, GO-2026-5415.