CVE-2026-116188
Received Received - Intake

Integer Overflow in Rclone S3 Server

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116188
EUVD
EUVD-2026-109446

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone 1.75.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow flaw in rclone serve s3 versions 1.75.0 to 1.75.2. Attackers exploit it by sending two concurrent PUT requests with extremely large declared lengths, causing a signed 64-bit integer overflow. This bypasses memory limits, allowing out-of-order parts to be retained in memory and exhausting host resources.

Detection Guidance

To detect this vulnerability, check if your rclone version is between 1.75.0 and 1.75.2. Run 'rclone version' to verify. Monitor for unusual memory usage spikes during S3 multipart uploads. Check logs for concurrent PUT requests with extremely large content lengths.

Impact Analysis

An attacker could exploit this to cause memory exhaustion on the host running rclone serve s3, leading to denial of service. The attack requires only network access and no authentication, making it easy to trigger remotely. System performance may degrade or the service may crash entirely.

Compliance Impact

This vulnerability primarily causes memory exhaustion through denial of service, which may indirectly impact compliance by disrupting system availability required for data processing or storage operations under standards like GDPR or HIPAA. However, the vulnerability does not directly affect data confidentiality or integrity.

Mitigation Strategies

Upgrade rclone to version 1.75.2 or later immediately. If upgrading is not possible, disable the S3 serve functionality or restrict network access to it. Monitor memory usage closely for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart