CVE-2026-88045 in rclone
Summary
by MITRE • 09/10/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in rclone versions from 1.75.0 to 1.75.1 represents a critical resource exhaustion flaw within the S3 streaming multipart serve functionality, specifically located in the cmd/serve/s3/multipart.go module. This component is responsible for handling large file uploads via the Amazon S3 compatible API interface, which allows clients to upload objects by dividing them into multiple parts and assembling them on the server side. The core technical flaw stems from an improper validation of the Content-Length header provided by the client during the initiation or processing of a multipart upload request. Specifically, when rclone processes these requests, it passes the attacker-controlled contentLength value directly to the Reserve function within the multipart.NewRW() structure before actually reading and validating the subsequent body bytes sent over the network connection. This architectural decision creates a window where resource allocation occurs based on untrusted input without immediate verification of whether that data will be delivered or if its size is legitimate relative to system constraints.
The operational impact of this flaw is severe, leading directly to Denial of Service conditions through memory exhaustion and process blocking. The vulnerability manifests in two primary ways related to buffer management and pool allocation. First, the waitForTurn mechanism admits the current part along with one additional oversized part even when the internal buffer is empty, ignoring the configured --multipart-streaming-buffer-limit setting intended to cap resource usage. Second, the lib/pool component allocates memory pages of 1 MiB each based strictly on the Content-Length or X-Amz-Decoded-Content-Length headers provided by the client. Because these allocations happen prior to full body validation, a malicious actor can exploit this by sending requests with extremely large content length values while withholding the actual data transmission. This allows an attacker to retain or multiply memory reservations indefinitely without fulfilling the corresponding network payload requirements.
From a security classification perspective, this vulnerability aligns closely with CWE-400: Uncontrolled Resource Consumption and CWE-770: Allocation of Resources Without Limits or Throttling in the context of resource exhaustion attacks. In terms of offensive tactics, it maps to MITRE ATT&CK technique T1496: Resource Hijacking, where an adversary consumes significant system resources such as memory or CPU cycles to degrade service availability for legitimate users. The attack vector is network-based and can be executed remotely by any client capable of establishing a connection to the rclone S3 endpoint. For deployments that do not require authentication (anonymous access), this vulnerability is trivially exploitable by anyone on the internet with reachability to the host. In environments where auth_key credentials are required, an attacker must first obtain valid S3 keys through credential theft or misconfiguration before they can trigger the resource exhaustion condition.
The consequences of a successful exploit include significant degradation of service performance for all users sharing the rclone instance, potential crashes of the process due to out-of-memory errors, and permanent blocking of request handlers if the internal buffers become saturated with reserved but unused memory slots. This effectively renders the cloud storage interface unusable until the affected processes are restarted or manually terminated by an administrator. The issue highlights a critical gap in input validation practices within high-throughput file synchronization tools that handle untrusted network inputs for resource allocation decisions.
Mitigation strategies focus primarily on immediate version upgrades and defensive configuration adjustments. Users running rclone versions 1.75.0 through 1.75.1 must upgrade to version 1.75.1 or later, where the developers have implemented fixes to properly validate content lengths against buffer limits before allocating memory pages. For environments that cannot immediately patch due to operational constraints, administrators should enforce strict authentication policies using strong auth_key credentials to prevent anonymous access from being exploited by external attackers. Additionally, configuring lower values for --multipart-streaming-buffer-limit can help mitigate the severity of resource exhaustion by capping the maximum amount of memory reserved per request sequence, although this does not fully eliminate the risk if an attacker sends multiple concurrent requests with oversized headers. Network-level rate limiting and ingress filtering may also provide a secondary layer of defense against volumetric attacks targeting this specific endpoint.