CVE-2026-116188: rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

Q: What conditions are required to exploit this issue?

An attacker must be able to send multipart PUT requests to an exposed rclone serve s3 endpoint. The attack uses two concurrent current-part PUT requests with declared lengths large enough to overflow the signed 64-bit multipart reorder-memory counter.

Q: What is the operational impact of a successful attack?

The overflow bypasses the configured buffer limit, allowing out-of-order multipart data to remain in memory. This can exhaust host memory and cause a denial of service.

Q: Which deployments should be prioritized for remediation?

Prioritize rclone serve s3 deployments running versions 1.75.0 through before 1.75.2 that accept multipart PUT requests from untrusted or broadly accessible clients. The issue is remotely exploitable without authentication or user interaction according to the supplied vector.

Published Oct 25, 2026

Updated

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.

Affected Software

1 affected component

Rclone rclone serve s3>=1.75.0<1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rclone serve s3 to a version that resolves this vulnerability.
Fixed in 1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker must be able to send multipart PUT requests to an exposed rclone serve s3 endpoint. The attack uses two concurrent current-part PUT requests with declared lengths large enough to overflow the signed 64-bit multipart reorder-memory counter.

What is the operational impact of a successful attack?

The overflow bypasses the configured buffer limit, allowing out-of-order multipart data to remain in memory. This can exhaust host memory and cause a denial of service.

Which deployments should be prioritized for remediation?

Prioritize rclone serve s3 deployments running versions 1.75.0 through before 1.75.2 that accept multipart PUT requests from untrusted or broadly accessible clients. The issue is remotely exploitable without authentication or user interaction according to the supplied vector.

CVE-2026-116188: rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to exploit this issue?

What is the operational impact of a successful attack?

Which deployments should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to exploit this issue?

What is the operational impact of a successful attack?

Which deployments should be prioritized for remediation?