Integer overflow in rclone - #VU155809
Published: October 15, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the waitForTurn multipart reorder-memory accounting in rclone serve s3 when processing concurrent multipart upload requests with oversized declared content lengths. A remote attacker can open two requests for the current part, each declaring 5,000,000,000,000,000,000 bytes while withholding their bodies, and then send out-of-order part bodies that bypass the configured memory limit to cause a denial of service.
Exploitation requires multipart streaming to be enabled. Anonymous exploitation is possible when neither --auth-key nor --auth-proxy is configured; otherwise, an accepted S3 credential is required.