Live › vulnerability › CVE-2026-116188
Go to dashboardrclone serve s3 versions 1.75.0 before 1.75.2 miscount memory used for out-of-order multipart parts because a signed int64 counter wraps. An attacker sending two concurrent part uploads with huge declared lengths can bypass the configured buffer limit and exhaust host memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone's S3-compatible server (rclone serve s3) and accept multipart uploads from clients they do not fully trust. Hosts that only use rclone as a client, or that run versions outside 1.75.0 to 1.75.2, are not affected by this flaw.
No product ranges from the sources yet.
rclone version and check whether it reports a version from 1.75.0 up to, but not including, 1.75.2rclone serve s3 is running on the host, for example with ps aux | grep "rclone serve s3"1.75.2 or laterrclone serve s3 to untrusted networksEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.
This page as .md · .json · in your agent: get_signal("CVE-2026-116188")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.