# MinIO AIStor KES RELEASE.2026-08-24T11-11-49Z

Released: 2026-08-24

This release rebuilds MinIO AIStor KES with the Go 1.26.6 toolchain, clearing seven Go standard library security advisories — including a TLS denial-of-service issue that a malicious client could trigger against the KES server. All deployments should upgrade.

---

## Downloads

### Binary Downloads

| Platform | Architecture | Download                                                                     |
| -------- | ------------ | ---------------------------------------------------------------------------- |
| Linux    | amd64        | [kes](https://dl.min.io/aistor/kes/release/linux-amd64/kes)                  |
| Linux    | arm64        | [kes](https://dl.min.io/aistor/kes/release/linux-arm64/kes)                  |
| macOS    | arm64        | [kes](https://dl.min.io/aistor/kes/release/darwin-arm64/kes)                 |
| macOS    | amd64        | [kes](https://dl.min.io/aistor/kes/release/darwin-amd64/kes)                 |
| Windows  | amd64        | [kes.exe](https://dl.min.io/aistor/kes/release/windows-amd64/kes.exe)        |

### FIPS Binaries

| Platform | Architecture | Download                                                                     |
| -------- | ------------ | ---------------------------------------------------------------------------- |
| Linux    | amd64        | [kes.fips](https://dl.min.io/aistor/kes/release/linux-amd64/kes.fips)        |

Checksums (`.sha256sum`) and signatures (`.asc`, `.minisig`) are published alongside each binary under the same path.

### Container Images

```bash
# Standard
docker pull quay.io/minio/aistor/kes:RELEASE.2026-08-24T11-11-49Z
podman pull quay.io/minio/aistor/kes:RELEASE.2026-08-24T11-11-49Z

# FIPS
docker pull quay.io/minio/aistor/kes:RELEASE.2026-08-24T11-11-49Z.fips
podman pull quay.io/minio/aistor/kes:RELEASE.2026-08-24T11-11-49Z.fips
```

---

## Security Updates

MinIO AIStor KES is now built with Go 1.26.6 (up from Go 1.26.5), resolving seven Go standard library advisories (#51). The following affect code paths exercised by the KES server and CLI:

- **Unbounded post-handshake TLS key derivation** — A malicious client could send an unlimited stream of `KeyUpdate` messages, forcing the server into indefinite key derivation work and consuming CPU. Go 1.26.6 caps the number of post-handshake messages accepted. Most relevant for KES servers reachable by untrusted clients. ([GO-2026-6090](https://pkg.go.dev/vuln/GO-2026-6090) / [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862))

- **`ReadHeaderTimeout` bypass on unencrypted HTTP/2 detection** — The configured header-read timeout was not applied while the server probed a new connection for the HTTP/2 client preface, allowing connections to be held open past their intended limit. ([GO-2026-6089](https://pkg.go.dev/vuln/GO-2026-6089) / [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853))

- **Quadratic complexity in URL path resolution** — Resolving relative paths containing many `..` segments scaled quadratically in time and allocations, giving a request-parsing amplification vector. Path resolution now uses index-based backtracking over a byte buffer. ([GO-2026-6218](https://pkg.go.dev/vuln/GO-2026-6218) / [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860))

- **Stack exhaustion parsing deeply nested ASN.1** — `encoding/asn1` now enforces a recursion limit during unmarshalling, protecting X.509 certificate parsing from deeply nested recursive structures. This applies to client certificate handling during mTLS authentication. ([GO-2026-5972](https://pkg.go.dev/vuln/GO-2026-5972) / [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818))

- **Panic parsing malformed DNS SVCB/HTTPS records** — An invalid record whose parameter value overflowed the message buffer could panic the resolver, reachable through hostname lookups against KMS backends. ([GO-2026-5942](https://pkg.go.dev/vuln/GO-2026-5942) / [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600))

Also fixed in the toolchain, affecting packages KES reaches only indirectly through its dependencies:

- **Stack exhaustion in XML decoding** — `Decoder.DecodeElement` reset the recursion depth counter, so the guard never fired. ([GO-2026-6088](https://pkg.go.dev/vuln/GO-2026-6088) / [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859))
- **JavaScript regexp context tracking in `html/template`** — Pathological input could close an unescaped `/` early, permitting content injection. ([GO-2026-6091](https://pkg.go.dev/vuln/GO-2026-6091) / [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858))

**Upgrade recommendation:** Upgrade at your earliest convenience. Prioritize KES servers whose TLS listener is reachable from untrusted networks, as the `KeyUpdate` issue is remotely triggerable without authentication.

---

## Security & Compliance

### Software Bill of Materials (SBOM)

This release includes comprehensive SBOM documentation in multiple formats:

- [SPDX JSON](sbom-RELEASE.2026-08-24T11-11-49Z.spdx.json) - Standard SBOM format
- [CycloneDX JSON](sbom-RELEASE.2026-08-24T11-11-49Z.cyclonedx.json) - Security scanner compatible
- [Go Modules](go-modules-RELEASE.2026-08-24T11-11-49Z.txt) - Human-readable dependency list

SBOM files document all direct and transitive dependencies for security auditing and compliance requirements.

---

## Upgrade Instructions

For detailed upgrade instructions, please read: https://docs.min.io/enterprise/aistor-key-encryption-service/upgrade-aistor-kes/

Platform-specific upgrade guides:

- **Linux/Bare Metal**: https://docs.min.io/enterprise/aistor-key-encryption-service/upgrade-aistor-kes/upgrade-aistor-linux/
- **Kubernetes with Helm**: https://docs.min.io/enterprise/aistor-key-encryption-service/upgrade-aistor-kes/upgrade-aistor-kubernetes-helm/

This is a drop-in upgrade. No configuration changes, key migration, or client updates are required.

### Support

For enterprise support:

- SUBNET Support: https://subnet.min.io
- Documentation: https://docs.min.io