BIT-rclone-2026-116188: rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/rcloneto a version that resolves this vulnerability.Fixed in 1.75.2 - Upgrade
Upgrade
rclone serve s3to a version that resolves this vulnerability.Fixed in 1.75.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running the rclone S3 server mode are exposed if they use versions 1.75.0 before 1.75.2. The issue concerns multipart upload reorder-memory accounting.
What does an attacker need to do to exploit it?
An attacker needs network access to send multipart PUT requests to the S3 service. Exploitation uses two concurrent current-part PUT requests with declared lengths large enough to wrap the signed int64 memory counter.
What is the operational impact of successful exploitation?
The configured buffer limit can be bypassed, allowing out-of-order multipart parts to remain in memory. This can exhaust host memory and reduce availability.
What should be done if the affected service cannot be updated immediately?
The provided data identifies the multipart PUT request pattern and requires two concurrent requests, but does not provide a documented mitigation other than avoiding the affected versions. Restricting untrusted network access to the S3 service may reduce exposure, but its effectiveness is not established in the provided data.