SILO Security Chronicle
This is the security chronicle of the SILO community fork. It follows the incidents in the order they were investigated and fixed. Each CVE has its own article: the original threat model, the turns taken during review, the rejected alternatives, the final invariant, the evidence, and the compatibility cost all stay with that incident.
Chronicle
| Date | CVE | Incident | First containing release |
|---|---|---|---|
| 2026-04-15 | CVE-2026-32285 | The jsonparser advisory that required no patch | Already fixed in the dependency graph |
| 2026-04-15 | CVE-2026-33322 | OIDC JWT algorithm confusion | SILO 2026-04-17 |
| 2026-04-15 | CVE-2026-33419 | LDAP STS enumeration and throttling | SILO 2026-04-17; completed in 2026-06-18 |
| 2026-04-15 | CVE-2026-34204 | Replication metadata injection | SILO 2026-04-17 |
| 2026-04-15 | CVE-2026-39414 | Oversized records in S3 Select | SILO 2026-04-17; completed in 2026-06-18 |
| 2026-04-16 | CVE-2026-40344 | Snowball auto-extract authentication bypass | SILO 2026-04-17 |
| 2026-04-16 | CVE-2026-41145 | Unsigned-trailer query authentication bypass | SILO 2026-04-17 |
| 2026-06-12 | CVE-2026-42600 | ReadMultiple storage-REST path traversal | SILO 2026-06-18 |
The articles below are ordered chronologically; incidents investigated on the same day are ordered by CVE number. Dependency-only CVEs remain in the relevant release notes instead of being inflated into application-level incident stories.
CVE-2026-32285: The jsonparser Advisory That Required No Patch
April 15, 2026 in Security Chronicle
Status: Closed without a code change GitHub issue: pgsty/minio#26 Security maintenance is not always a sequence of “find a vulnerability, then ship a patch.” The initial assessment of CVE-2026-32285 was that the repository might still carry a …
Status: Closed without a code change GitHub issue: pgsty/minio#26 Security maintenance is not always a sequence of “find a vulnerability, then ship a patch.” The initial assessment of CVE-2026-32285 was that the repository might still carry a …
CVE-2026-33322: OIDC JWT Algorithm Confusion
April 15, 2026 in Security Chronicle
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants GitHub issue: pgsty/minio#22 The old implementation placed the OIDC client secret in the JWT verifier …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z Affected entry points: AssumeRoleWithWebIdentity, AssumeRoleWithClientGrants GitHub issue: pgsty/minio#22 The old implementation placed the OIDC client secret in the JWT verifier …
CVE-2026-33419: LDAP STS Enumeration and the Throttling Chain
April 15, 2026 in Security Chronicle
Status: Released, followed by two rounds of corrections First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z GitHub issue: pgsty/minio#23 The core vulnerability was straightforward: LDAP STS …
Status: Released, followed by two rounds of corrections First containing release: RELEASE.2026-04-17T00-00-00Z Complete correction: RELEASE.2026-06-18T00-00-00Z GitHub issue: pgsty/minio#23 The core vulnerability was straightforward: LDAP STS …
CVE-2026-34204: Replication Metadata Injection
April 15, 2026 in Security Chronicle
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z GitHub issue: pgsty/minio#24 Ordinary PUT and COPY requests could smuggle X-Minio-Replication-* headers into internal X-Minio-Internal-* SSE metadata, creating objects whose …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z GitHub issue: pgsty/minio#24 Ordinary PUT and COPY requests could smuggle X-Minio-Replication-* headers into internal X-Minio-Internal-* SSE metadata, creating objects whose …
CVE-2026-39414: Oversized S3 Select Records and a SIMD Bypass
April 15, 2026 in Security Chronicle
Status: Released; the second-round fix was completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z GitHub issue: pgsty/minio#25 The first fix in April reused the existing 1 MiB …
Status: Released; the second-round fix was completed in June Initial fix release: RELEASE.2026-04-17T00-00-00Z Complete fix release: RELEASE.2026-06-18T00-00-00Z GitHub issue: pgsty/minio#25 The first fix in April reused the existing 1 MiB …
CVE-2026-40344: Snowball Auto-Extract Authentication Bypass
April 16, 2026 in Security Chronicle
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler omitted the streaming unsigned-trailer authentication case. A tar stream with a forged signature …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z GitHub advisory: GHSA-9c4q-hq6p-c237 Snowball’s PutObjectExtractHandler omitted the streaming unsigned-trailer authentication case. A tar stream with a forged signature …
CVE-2026-41145: Unsigned-Trailer Query Authentication Bypass
April 16, 2026 in Security Chronicle
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z GitHub advisory: GHSA-hv4r-mvr4-25vw Query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER data flow, while the old code verified the signature only …
Status: Released First containing release: RELEASE.2026-04-17T00-00-00Z GitHub advisory: GHSA-hv4r-mvr4-25vw Query-string SigV4 credentials could enter a STREAMING-UNSIGNED-PAYLOAD-TRAILER data flow, while the old code verified the signature only …
CVE-2026-42600: ReadMultiple Storage-REST Path Traversal
June 12, 2026 in Security Chronicle
Status: Released First containing release: RELEASE.2026-06-18T00-00-00Z GitHub advisory: GHSA-xh8f-g2qw-gcm7 Affected scope: Distributed erasure only; cluster-root / internode JWT required The msgpack body of /rmpl carried Bucket, Prefix, and Files. …
Status: Released First containing release: RELEASE.2026-06-18T00-00-00Z GitHub advisory: GHSA-xh8f-g2qw-gcm7 Affected scope: Distributed erasure only; cluster-root / internode JWT required The msgpack body of /rmpl carried Bucket, Prefix, and Files. …