rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rclone is a command-line program to sync files and directories to and from different cloud storage
    providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go
    passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes.
    waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-
    streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-
    Content-Length. A network client can retain or multiply these reservations without sending the declared
    body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments
    require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed
    in version 1.75.1. (CVE-2026-88045)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go     passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes.
    waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-     streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-     Content-Length. A network client can retain or multiply these reservations without sending the declared     body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments     require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed     in version 1.75.1. (CVE-2026-88045)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447940	SCA: security update for github.com/rclone/rclone (GHSA-2p48-j3qc-rx9f)	Tenable Cloud Security	SCA Checks	Local	high
447940	SCA: security update for github.com/rclone/rclone (GHSA-2p48-j3qc-rx9f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344713	Linux Distros Unpatched Vulnerability : CVE-2026-88045	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88045

high

Tenable Plugins

high

high

high