S3 Select on SILOhttps://silo.pgsty.com/tags/s3-select/Recent content in S3 Select on SILOHugoenSun, 02 Aug 2026 15:22:46 +0800CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypasshttps://silo.pgsty.com/blog/security/cve-2026-39414/Wed, 15 Apr 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-39414/<p><strong>Status:</strong> Released; the second-round fix was completed in June<br> <strong>Initial fix release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-04-17T00-00-00Z">RELEASE.2026-04-17T00-00-00Z</a><br> <strong>Complete fix release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-06-18T00-00-00Z">RELEASE.2026-06-18T00-00-00Z</a><br> <strong>GitHub issue:</strong> <a href="https://github.com/pgsty/minio/issues/25">pgsty/minio#25</a></p> <p>The first fix in April reused the existing 1 MiB <code>maxCharsPerRecord</code> limit for both CSV and ordinary JSON Lines. This prevented unbounded buffering while waiting for a delimiter and returned the explicit <code>OverMaxRecordSize</code> error to clients. A June review then found that CPUs with SIMD support took a different <code>simdjson</code> fast path that bypassed the limit completely.</p>