Integer Overflow in rclone Serve S3 Affects Memory Management
CVE-2026-116188

6.9MEDIUM

Key Information:

Vendor

Rclone

Status
Rclone
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116188?

The rclone Serve S3 functionality versions 1.75.0 through 1.75.1 are susceptible to an integer overflow vulnerability due to inadequate memory accounting in multipart reorder. This weakness enables attackers to send simultaneous PUT requests with excessively large lengths, causing the signed int64 counter to wrap. As a result, the system can retain out-of-order parts in memory, potentially leading to resource exhaustion and denial of service on the affected host.

Affected Version(s)

rclone 1.75.0 < 1.75.2

rclone 1.75.2

References

https://github.com/rclone/rclone/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/rclone-serve-s3-1.75...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
ncw
mayank-jangid-moon
skigeek16
opensec-intelligence
.