https://silo.pgsty.com/tags/snowball/Recent content in Snowball on SILOHugoenSun, 02 Aug 2026 15:22:46 +0800https://silo.pgsty.com/blog/security/cve-2026-40344/Thu, 16 Apr 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-40344/<p><strong>Status:</strong> Released<br> <strong>First containing release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-04-17T00-00-00Z">RELEASE.2026-04-17T00-00-00Z</a><br> <strong>GitHub advisory:</strong> <a href="https://github.com/advisories/GHSA-9c4q-hq6p-c237">GHSA-9c4q-hq6p-c237</a></p> <p>Snowball&rsquo;s <code>PutObjectExtractHandler</code> omitted the streaming unsigned-trailer authentication case. A tar stream with a forged signature could enter <code>untar()</code> before authentication completed, and one request could fan out into many object writes. The final fix initialized the correct reader, handled the decoded length, and completed SigV4 verification before any tar byte reached the extractor.</p> <h2 id="cve-number">Why the identifier changed</h2> <p>The official CVE had not been assigned when the fix was written, so the commit subject used the temporary identifier <code>fake CVE-2026-40028</code>. The final identifier is <strong>CVE-2026-40344</strong>. The historical commit was not rewritten; the advisory and this article use the official number.</p>