CVE-2026-88045High· 7.5▾ MidnightPoC availablerclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentL…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/rclone/rclone >= 1.75.0, < 1.75.1Patched in:
github.com/rclone/rclone 1.75.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88018Critical· 9.8rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88044Critical· 9.1rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88015Medium· 5.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88013Low· 3.7rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88016High· 7.1rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88046Medium· 5.3rclone is a command-line program to sync files and directories to and from different cloud storage providers