CVE-2026-116188EUVD-2026-109446GHSA-6475-788V-W6C3GHSA-QJW8-8HMP-C3M6
rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.75.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- rclone rclone
From 1.75.0 · fixed in 1.75.2