CVE-2026-88045

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-88045", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-09T21:22:45.433Z", "datePublished": "2026-09-10T16:11:39.800Z", "dateUpdated": "2026-09-10T17:31:43.950Z"}, "containers": {"cna": {"title": "rclone: S3 multipart declared-length memory exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f"}, {"name": "https://github.com/rclone/rclone/issues/9616", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/issues/9616"}, {"name": "https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1"}, {"name": "https://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86"}, {"name": "https://github.com/rclone/rclone/releases/tag/v1.75.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/releases/tag/v1.75.1"}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"version": ">= 1.75.0, < 1.75.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-10T16:11:39.800Z"}, "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1."}], "source": {"advisory": "GHSA-2p48-j3qc-rx9f", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-10T17:31:12.490937Z", "id": "CVE-2026-88045", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T17:31:43.950Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-88045", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T17:31:12.490937Z"}}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T17:31:35.004Z"}}], "cna": {"title": "rclone: S3 multipart declared-length memory exhaustion", "source": {"advisory": "GHSA-2p48-j3qc-rx9f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": ">= 1.75.0, < 1.75.1"}]}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f", "name": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rclone/rclone/issues/9616", "name": "https://github.com/rclone/rclone/issues/9616", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1", "name": "https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86", "name": "https://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rclone/rclone/releases/tag/v1.75.1", "name": "https://github.com/rclone/rclone/releases/tag/v1.75.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-10T16:11:39.800Z"}}}, "cveMetadata": {"cveId": "CVE-2026-88045", "state": "PUBLISHED", "dateUpdated": "2026-09-10T17:31:43.950Z", "dateReserved": "2026-09-09T21:22:45.433Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-10T16:11:39.800Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rclone", "vendor": "rclone", "versions": [{"status": "affected", "version": ">= 1.75.0, < 1.75.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1."}], "id": "CVE-2026-88045", "lastModified": "2026-09-10T19:54:25.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88045", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T17:31:12.490937Z", "version": "2.0.3"}}]}, "published": "2026-09-10T17:17:08.530", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/issues/9616"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/releases/tag/v1.75.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: Memory exhaustion leading to Denial of Service", "id": "2531549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531549"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in rclone. A remote attacker can exploit a memory exhaustion vulnerability in the S3 streamed multipart path. By manipulating the `Content-Length` or `X-Amz-Decoded-Content-Length` headers, an attacker can cause the application to reserve excessive memory without sending the declared body. This can lead to the exhaustion of process or host memory, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "No mitigation is required for the Red Hat products evaluated because they do not ship the affected rclone version. Users running rclone independently should upgrade to version 1.75.1 or later."}, "name": "CVE-2026-88045", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Not affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-09-10T16:11:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-88045\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88045\nhttps://github.com/rclone/rclone/commit/7c1dfd99f3e6a22fcefd8686cc478226a15e63a1\nhttps://github.com/rclone/rclone/commit/ab1f458013aaf6356e4bdeca61f7cb9139f8eb86\nhttps://github.com/rclone/rclone/issues/9616\nhttps://github.com/rclone/rclone/releases/tag/v1.75.1\nhttps://github.com/rclone/rclone/security/advisories/GHSA-2p48-j3qc-rx9f"], "statement": "Red Hat has determined that the Red Hat products evaluated for this vulnerability are not affected. They ship rclone versions earlier than 1.75.0, while the affected release is rclone 1.75.0.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.75.0,1.75.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-09-10T20:00:04.597601+00:00", "updated": "2026-09-21T05:30:07.490365+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}