CVE-2026-88045
Received Received - Intake

Memory Exhaustion in Rclone S3 Multipart Streaming

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88045
EUVD
EUVD-2026-75588

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rclone rclone to 1.75.1 (exc)
rclone rclone 1.75.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88045 is a memory exhaustion vulnerability in rclone's S3 server implementation. It occurs when handling multipart uploads where the server reserves memory based on attacker-controlled Content-Length headers before reading any actual data. This allows unauthenticated clients to force excessive memory allocation without sending corresponding data, leading to denial-of-service through resource exhaustion.

Detection Guidance

To detect this vulnerability, monitor for unusual memory usage spikes in rclone S3 server processes, especially during multipart upload operations. Check for processes consuming excessive memory without corresponding network traffic. Use system monitoring tools like top, htop, or ps to observe memory consumption patterns. Look for rclone processes with high RES (resident memory) values that grow disproportionately to actual data transfer.

Impact Analysis

This vulnerability can impact you by causing your rclone S3 server to run out of memory, crash, or become unresponsive. Attackers can exploit it to terminate processes or block request handling without authentication in default setups. It may also lead to service unavailability or increased operational costs due to resource exhaustion.

Mitigation Strategies
  • Upgrade rclone to version 1.75.1 or later immediately to patch the vulnerability.
  • If upgrading is not immediately possible, disable anonymous S3 access in your rclone configuration to prevent unauthenticated exploitation.
  • Implement strict limits on multipart upload part sizes in your S3 server configuration to prevent excessive memory allocation.
  • Monitor rclone S3 server memory usage closely and set up alerts for abnormal memory consumption patterns.
  • Consider limiting client concurrency to 1 as a temporary workaround until a permanent fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart