S3 on SILO

MinIO Fork, Promise Kept

Fri, 17 Apr 2026 00:00:00 +0000

Two months after forking MinIO, pgsty/minio ships patches for four CVEs and related security issues. No new features — just working builds, a restored console, and timely security fixes.

MinIO Is Dead, Long Live MinIO

Sat, 14 Feb 2026 00:00:00 +0000

MinIO’s repo is officially archived and abandoned. And how AI Agents helped bring it back from the dead. This post explains how a community fork restores the admin console and ships binaries via CI/CD pipeline.

CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass

Wed, 15 Apr 2026 00:00:00 +0000

Status: Released; the second-round fix was completed in June
Initial fix release: RELEASE.2026-04-17T00-00-00Z
Complete fix release: RELEASE.2026-06-18T00-00-00Z
GitHub issue: pgsty/minio#25

The first fix in April reused the existing 1 MiB maxCharsPerRecord limit for both CSV and ordinary JSON Lines. This prevented unbounded buffering while waiting for a delimiter and returned the explicit OverMaxRecordSize error to clients. A June review then found that CPUs with SIMD support took a different simdjson fast path that bypassed the limit completely.

CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass

Thu, 16 Apr 2026 00:00:00 +0000

Status: Released
First containing release: RELEASE.2026-04-17T00-00-00Z
GitHub advisory: GHSA-hv4r-mvr4-25vw

Query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER data flow, while the old code verified the signature only when an Authorization header was present. A request carrying a valid access-key identifier could therefore complete a write without a correct signature.

The final fix moved presigned rejection and SigV4 verification into newUnsignedV4ChunkedReader(), making every caller consuming that stream share one authentication boundary.

Identifier note

The official CVE had not been assigned when the patch was written, so its commit subject used fake CVE-2026-40027. The final identifier is CVE-2026-41145. The historical commit remains unchanged; public material uses the official identifier.