CVE-2026-116188rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

Açıklama

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-qjw8-8hmp-c3m6) vendor-advisoryVendor Advisory
• VulnCheck Advisory: rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow third-party-advisoryThird Party Advisory