rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes. waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-Content-Length. A network client can retain or multiply these reservations without sending the declared body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed in version 1.75.1.

The version of Rclone installed on the remote host is 1.75.0. It is, therefore, affected by a denial of service vulnerability:

  - In streamed multipart mode, rclone serve s3 passes the request's declared part length to     multipart.NewRW().Reserve(contentLength) before reading any part data, which immediately     obtains enough 1 MiB pool pages for the entire declared length. A network client can therefore     cause the server to reserve memory proportional to an unverified Content-Length or     X-Amz-Decoded-Content-Length header without transmitting the corresponding body, and
    --multipart-streaming-buffer-limit does not cap the allocation for the current expected part.
    A sufficiently large declared length, or concurrent requests, can exhaust process or host     memory or permanently block request goroutines, resulting in loss of S3 service availability.
    (CVE-2026-88045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rclone is a command-line program to sync files and directories to and from different cloud storage
    providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go
    passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes.
    waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-
    streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-
    Content-Length. A network client can retain or multiply these reservations without sending the declared
    body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments
    require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed
    in version 1.75.1. (CVE-2026-88045)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go     passes attacker-controlled contentLength to multipart.NewRW().Reserve before reading request-body bytes.
    waitForTurn admits the current part and one oversized part when the buffer is empty despite --multipart-     streaming-buffer-limit, and lib/pool allocates 1 MiB pages according to Content-Length or X-Amz-Decoded-     Content-Length. A network client can retain or multiply these reservations without sending the declared     body, exhausting process or host memory or permanently blocking request handlers. Anonymous S3 deployments     require no credentials, while deployments using auth_key require an accepted S3 key. This issue is fixed     in version 1.75.1. (CVE-2026-88045)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346830	Rclone 1.75.0 S3 Multipart Declared-Length Memory Exhaustion (CVE-2026-88045)	Nessus	Misc.	Local	high
447940	SCA: security update for github.com/rclone/rclone (GHSA-2p48-j3qc-rx9f)	Tenable Cloud Security	SCA Checks	Local	high
447940	SCA: security update for github.com/rclone/rclone (GHSA-2p48-j3qc-rx9f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344713	Linux Distros Unpatched Vulnerability : CVE-2026-88045	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88045

high

Tenable Plugins

high

high

high

high