BIT-RCLONE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

PT-2026-132473

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

SUSE CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

UBUNTU-CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

Linux Distros Unpatched Vulnerability : CVE-2026-116188

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buff...

ALPINE-CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188

The rclone serve s3 component in versions 1.75.0 before 1.75.2 is vulnerable to an integer overflow within the multipart reorder-memory accounting logic. This flaw allows an attacker to bypass configured buffer limits by initiating two concurrent current-part PUT requests with extremely large dec...

EUVD-2026-109446

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

CVE-2026-116188

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain...

PT-2026-123029

Name of the Vulnerable Software and Affected Versions rclone versions 1.75.0 through 1.75.1 Description An integer overflow exists in the multipart reorder-memory accounting of the S3 server implementation. This issue allows the configured buffer limit to be bypassed. An attacker can trigger this...

PT-2026-120914

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery CSRF. An attacker could trick an editor into visiting a crafted link, which...

Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery CSRF. An attacker could trick an editor into visiting a crafted link, which...

CVE-2026-90377

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. This issue affects the Receive Reorder Offload RRO 3.0 data queuing mechanism. Incorrect handling of received data frames can cause them to stall and be reordered within the driver. This can lead to a denial of service or data integrity...

CLSA-2025-1757961506 kernel: Fix of 28 CVEs

posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - xfrm: state: fix out-of-bounds read during lookup CVE-2024-57982 - nfsd: fix race between laundromat and freestateid CVE-2024-50106 - nfsd: split scstatus out of sctype CVE-2024-50106 - nfsd: avoid race...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padatareorder that goes back to the initial commit. A reference count is taken at the start of the process in padatadoparallel, and released at the end in...