rclone: S3 multipart declared-length memory exhaustion

Published September 10, 2026 CVE-2026-88045

rclone's S3 server can reserve excessive memory from a request header before receiving the file. An attacker can exhaust memory and make the service stop responding.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 1.75.1Fix recorded today
Affected versions
1.75.0 or newer, but before 1.75.1
Weakness
CWE-789
Exploit likelihood
0.54% in 30 daysEPSS, higher than 43% of known flaws
Affects
Rclone

How it works

  • An attacker can send an S3 multipart request with a claimed part size in its headers. rclone reserves memory for that full claimed size before reading the request body.
  • Its streaming buffer setting still allows an oversized current part when the buffer is empty.
  • One request or several concurrent requests can consume enough memory to stop the S3 service.

What to do

Run rclone version and compare the installed version with the advisory's affected range, from 1.75.0 until before 1.75.1. Check each deployment that exposes rclone's S3 server with streamed multipart uploads.

Update rclone to version 1.75.1 using the vendor's security advisory. Verify that every exposed S3 deployment reports version 1.75.1.

Technical details

The streamed S3 multipart path reserves 1 MiB memory pages based on Content-Length or X-Amz-Decoded-Content-Length before body bytes arrive. The issue affects availability only and is fixed in version 1.75.1.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source