CVE-2026-88045: rclone: S3 multipart declared-length memory exhaustion
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using authkey require an accepted S3 key. This issue is fixed in version 1.75.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.1
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated attack?
rclone S3 servers configured for anonymous access can be attacked without credentials. Servers using auth_key require the attacker to possess an accepted S3 key.
What does an attacker need to do to exhaust memory or block handlers?
A network client can send multipart requests with attacker-controlled Content-Length or X-Amz-Decoded-Content-Length values, causing memory reservations before request-body bytes are read. The client can retain these reservations or create multiple requests without sending the declared bodies.
Does the multipart streaming buffer limit prevent this condition?
No. When the buffer is empty, waitForTurn can admit the current part and one oversized part despite --multipart-streaming-buffer-limit.
What should be done to remediate the issue?
Upgrade to rclone version 1.75.1, which fixes the issue. The affected versions are from 1.75.0 until 1.75.1.