EUVD-2026-75588
GHSA-2p48-j3qc-rx9f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconConnect to rclone serve s3 network endpoint
-
DeliveryInitiate multipart upload via CreateMultipartUpload
-
ExploitSend UploadPart requests with large Content-Length, no body bytes
-
InstallTrigger pre-allocation of 1 MiB pool pages per request
-
C2Bypass streaming buffer limit via waitForTurn race
-
ExecuteExhaust process or host memory
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Exploitation requires the target to be running 'rclone serve s3' using rclone v1.75.0 specifically - the multipart streaming feature was introduced in this version and the vulnerability was introduced with it. For anonymous deployments (no --auth-key flag set), no credentials are required and any network-reachable client can exploit this. For deployments configured with --auth-key, the attacker must present an accepted S3 access key ID; once authenticated, any key holder can trigger the issue. The --multipart-streaming-buffer-limit flag does not reliably block exploitation because waitForTurn admits one additional oversized part when the internal buffer is empty, partially bypassing the cap. Exploitation is limited to the UploadPart API endpoint within multipart upload flows; standard single-part PutObject requests are not affected. |
| Impact | The provided CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is accurate for the most exposed deployment case - anonymous rclone serve s3 instances with no --auth-key configured, which require zero credentials. For auth-gated deployments, the effective privilege requirement rises to PR:L (a valid S3 key must be presented), which would reduce the base score to approximately 6.5. The CVE description explicitly distinguishes these two cases. The affected version window is narrow: only rclone 1.75.0 is vulnerable; versions prior to 1.75.0 lacked the multipart streaming feature, and v1.75.1 is patched. No EPSS score, CISA KEV listing, or public POC is available in the provided intelligence, suggesting limited active exploitation at time of analysis. Real-world priority is high for organizations running public-facing or lightly authenticated rclone S3 endpoints, but organizations that gate serve-s3 behind a VPN or firewalled network have significantly reduced exposure. The --multipart-streaming-buffer-limit flag is not a reliable workaround because the waitForTurn bypass allows one oversized reservation regardless of the limit setting. |
| Exploit ScenarioDerived | An unauthenticated remote attacker targeting a public-facing 'rclone serve s3' instance without --auth-key sends a CreateMultipartUpload request followed by a rapid stream of UploadPart requests, each declaring a Content-Length of several hundred megabytes but delivering no body. Each part causes rclone to pre-allocate 1 MiB pages totaling the declared size before timing out; the waitForTurn bypass allows an additional oversized reservation per cycle. Repeated across connections, the attacker exhausts process or host memory, crashing the server or permanently blocking all request handlers without sending any significant data volume. No public proof-of-concept code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
RemediationAI
Upgrade to rclone v1.75.1, which removes the pre-emptive buffer reservation tied to client-declared Content-Length so that memory is allocated only as body bytes arrive - confirmed by commits 7c1dfd99f3e6a22fcefd8686cc478226a15e63a1 and ab1f458013aaf6356e4bdeca61f7cb9139f8eb86 and the vendor advisory at https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f. If immediate upgrade is not possible, the most effective compensating control is to enable --auth-key on the serve s3 endpoint, which requires attackers to present a valid S3 credential and eliminates unauthenticated exploitation; note that this does not eliminate the vulnerability for authenticated users or compromised keys. Alternatively, restrict network access to the serve-s3 port to trusted IP ranges via firewall rules, preventing arbitrary clients from reaching the endpoint. Disabling 'rclone serve s3' entirely eliminates the attack surface but disrupts S3-compatible access for legitimate clients. The --multipart-streaming-buffer-limit flag should NOT be relied on as a mitigation, as the waitForTurn bypass allows one oversized reservation to bypass the limit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rclone's embedded S3 server (invoked via 'rclone serve s3') implements multipart object uploads in cmd/serve/s3/multipart.go. The vulnerable code path calls multipart.NewRW().Reserve(contentLength) in the UploadPart handler, where contentLength is derived directly from the client-supplied Content-Length or X-Amz-Decoded-Content-Length HTTP header. The underlying lib/pool allocator maps this value to 1 MiB pages, committing physical memory proportional to the declared - not delivered - body size. CWE-789 (Uncontrolled Memory Allocation) describes this class precisely: resource allocation is bounded by attacker input rather than verified input. Compounding the issue, the waitForTurn concurrency gate admits the current part plus one oversized part when the buffer is otherwise empty, creating a multiplier effect beyond a single request. The fix (commit 7c1dfd99) removes the eager .Reserve(contentLength) call so that the buffer grows incrementally, one page at a time, only as body bytes are actually received.
Know when Rclone gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Anonymous serve-s3 requires no credentials (PR:N, AV:N); impact is availability-only from memory exhaustion with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.
Technical POC Analysis
CWE-789: Memory Allocation with Excessive Size Value.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
rclone's S3 serve endpoint in version 1.75.0 is vulnerable to remote denial-of-service attacks via memory exhaustion, allowing attackers to crash the service or permanently block request handlers. Organizations using rclone for S3 file serving face potential service unavailability and resource consumption that could impact dependent applications and workflows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impers
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenti
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to appl
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Path traversal (Zip Slip class) in rclone's archive ZIP backend permits arbitrary file writes outside the intended desti
Denial of service in rclone prior to 1.75.1 allows unauthenticated remote attackers to crash individual HTTP or WebDAV c
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key seg
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote att
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Exploit-DB