https://silo.pgsty.com/module/blog/Recent content in BLOG on SILOHugoenhttps://silo.pgsty.com/blog/post/Mon, 01 Jan 0001 00:00:00 +0000https://silo.pgsty.com/blog/post/<p>Essays and analysis about MinIO, S3-compatible object storage, and the SILO community fork.</p>https://silo.pgsty.com/blog/release/Mon, 01 Jan 0001 00:00:00 +0000https://silo.pgsty.com/blog/release/<p>Each published SILO version has its own page with the release date, major changes, security fixes, dependency updates, and related commits.</p>https://silo.pgsty.com/blog/security/Mon, 01 Jan 0001 00:00:00 +0000https://silo.pgsty.com/blog/security/<p>This is the security chronicle of the SILO community fork. It follows the incidents in the order they were investigated and fixed. Each CVE has its own article: the original threat model, the turns taken during review, the rejected alternatives, the final invariant, the evidence, and the compatibility cost all stay with that incident.</p> <h2 id="chronicle">Chronicle</h2> <table> <thead> <tr> <th style="text-align: left">Date</th> <th style="text-align: left">CVE</th> <th style="text-align: left">Incident</th> <th style="text-align: left">First containing release</th> </tr> </thead> <tbody> <tr> <td style="text-align: left">2026-04-15</td> <td style="text-align: left">CVE-2026-32285</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-32285/">The <code>jsonparser</code> advisory that required no patch</a></td> <td style="text-align: left">Already fixed in the dependency graph</td> </tr> <tr> <td style="text-align: left">2026-04-15</td> <td style="text-align: left">CVE-2026-33322</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-33322/">OIDC JWT algorithm confusion</a></td> <td style="text-align: left">SILO 2026-04-17</td> </tr> <tr> <td style="text-align: left">2026-04-15</td> <td style="text-align: left">CVE-2026-33419</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-33419/">LDAP STS enumeration and throttling</a></td> <td style="text-align: left">SILO 2026-04-17; completed in 2026-06-18</td> </tr> <tr> <td style="text-align: left">2026-04-15</td> <td style="text-align: left">CVE-2026-34204</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-34204/">Replication metadata injection</a></td> <td style="text-align: left">SILO 2026-04-17</td> </tr> <tr> <td style="text-align: left">2026-04-15</td> <td style="text-align: left">CVE-2026-39414</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-39414/">Oversized records in S3 Select</a></td> <td style="text-align: left">SILO 2026-04-17; completed in 2026-06-18</td> </tr> <tr> <td style="text-align: left">2026-04-16</td> <td style="text-align: left">CVE-2026-40344</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-40344/">Snowball auto-extract authentication bypass</a></td> <td style="text-align: left">SILO 2026-04-17</td> </tr> <tr> <td style="text-align: left">2026-04-16</td> <td style="text-align: left">CVE-2026-41145</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-41145/">Unsigned-trailer query authentication bypass</a></td> <td style="text-align: left">SILO 2026-04-17</td> </tr> <tr> <td style="text-align: left">2026-06-12</td> <td style="text-align: left">CVE-2026-42600</td> <td style="text-align: left"><a href="https://silo.pgsty.com/blog/security/cve-2026-42600/"><code>ReadMultiple</code> storage-REST path traversal</a></td> <td style="text-align: left">SILO 2026-06-18</td> </tr> </tbody> </table> <p>The articles below are ordered chronologically; incidents investigated on the same day are ordered by CVE number. Dependency-only CVEs remain in the relevant <a href="https://silo.pgsty.com/blog/release/">release notes</a> instead of being inflated into application-level incident stories.</p>