CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion
A network client can exhaust memory in rclone's S3 server by sending oversized multipart headers, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-88045?
CVE-2026-88045 is a high-severity denial of service vulnerability in rclone, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.
Weakness: CWE-789
Which versions are affected by CVE-2026-88045?
4 open source packages ship an affected version, including github.com/rclone/rclone and rclone.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | From 1.75.0 | 1.75.1 |
github.com/rclone/rclone Go | From 1.75.0 | 1.75.1 |
github.com/rclone/rclone Go | From 1.75.0 | 1.75.1 |
rclone Bitnami | From 1.75.0 | 1.75.1 |
How do I fix CVE-2026-88045?
Upgrade github.com/rclone/rclone to 1.75.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-88045 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88045 exists.
Sources
Also known as BIT-rclone-2026-88045, DEBIAN-CVE-2026-88045, GHSA-2p48-j3qc-rx9f, GO-2026-6456, MINI-587c-qp29-rmj4, MINI-c5fv-5hr7-87fm and 3 more.