rclone: S3 multipart declared-length memory exhaustion

Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...

CVE-2026-88044

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...