Technical impact
The vulnerability resides in rclone serve s3 versions 1.75.0 through 1.75.1, where an integer overflow occurs in the multipart reorder‑memory accounting routine. By issuing two concurrent PUT requests with excessively large length headers, the signed 64‑bit counter can wrap, allowing out‑of‑order parts to be retained in memory beyond the configured buffer limit. This flaw can lead to uncontrolled memory consumption and eventually exhaust host resources, resulting in denial of service to legitimate users. The weakness is properly categorized as CWE‑190.
Affected Systems
The affected product is rclone v1.75.0–v1.75.1, shipped under the rclone repository. No other vendors or products are listed as impacted.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity. EPSS is not available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting limited public exploitation data. The likely attack vector is remote, via the S3 API over HTTP, requiring the ability to send concurrent PUT requests. An attacker does not need elevated local privileges and can trigger the overflow by crafting specially sized requests. Given the moderate CVSS score and the absence of widespread exploitation evidence, the risk is considered moderate but still warrants timely remediation.
