CVE-2026-116188 in Rclone
Summary
by MITRE • 10/25/2026
rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in rclone serve s3 versions prior to 1.75.2 represents a critical integer overflow flaw within the multipart upload handling logic, specifically affecting the memory accounting for reordered parts. This issue stems from an improper validation of numeric values during the processing of concurrent PUT requests that declare unusually large content lengths. When two or more such requests are initiated simultaneously, the internal signed int64 counter used to track buffer usage can wrap around due to arithmetic overflow. Instead of rejecting these oversized payloads based on the configured memory limits, the system miscalculates the available space, allowing out-of-order parts to be retained in memory beyond intended thresholds. This behavior effectively bypasses the protective buffer limits designed to prevent resource exhaustion, creating a significant security gap that can be exploited by remote attackers without authentication if the service is exposed publicly or lacks strict access controls.
From an operational perspective, this vulnerability leads directly to denial of service conditions through excessive memory consumption on the host system. By triggering the integer overflow condition repeatedly, an attacker can force the rclone process to allocate vast amounts of RAM for storing multipart upload parts that are never properly cleaned up due to the flawed accounting logic. This uncontrolled resource accumulation degrades system performance and eventually causes the application or underlying operating system to crash as it runs out of available memory resources. The impact is severe because it allows a relatively low-effort attack vector to disrupt service availability, impacting all users relying on the S3-compatible storage interface provided by rclone serve.
This flaw aligns with CWE-190, which describes integer overflow or wraparound vulnerabilities where arithmetic operations produce results that exceed the maximum value representable by the data type. Additionally, it maps to ATT&CK technique T1496, Resource Hijacking, specifically under sub-techniques involving resource exhaustion through memory consumption. The lack of proper bounds checking on signed integers during concurrent multi-part upload processing highlights a common pitfall in systems programming where assumptions about sequential or single-threaded behavior do not hold up under parallel execution conditions.
To mitigate this vulnerability, organizations must immediately upgrade rclone to version 1.75.2 or later, which includes patches for the multipart reorder-memory accounting logic and enforces stricter validation on part sizes before memory allocation. Administrators should also implement network-level rate limiting and connection throttling to restrict the number of concurrent uploads from any single source, thereby reducing the attack surface even if older versions are temporarily in use. Furthermore, deploying resource monitoring tools that alert on abnormal spikes in memory usage associated with rclone processes can provide early detection capabilities for potential exploitation attempts while patching efforts are underway.