rclone Go Package Memory Exhaustion Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- >= 1.75.0, <= 1.75.0
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the rclone Go package. This vulnerability, which allows for memory exhaustion attacks, affects version 1.75.0.
What happened
An early warning has been issued regarding a vulnerability in the rclone Go package. This vulnerability, tracked as GHSA-2P48-J3QC-RX9F, allows for memory exhaustion attacks by allocating memory based on the declared part length without a safe maximum limit. This can be exploited in deployments with anonymous access enabled. The vulnerability affects rclone version 1.75.0. The issue has not been exploited in the wild as of the latest reports.
The vulnerability was first flagged on 2026-09-10T22:45:14+00:00. The rclone team is investigating the issue and has recommended either upgrading to a fixed version of rclone or restricting S3 access to authenticated users only as interim measures.
What to do about it
- Check if your deployment uses rclone version 1.75.0.
- If you are using rclone version 1.75.0, upgrade to a version that includes a fix for this issue as soon as it becomes available.
- Restrict S3 access to authenticated users only as an interim measure.
- Monitor the primary sources for updates on a patched version.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rclone version 1.75.0.
What should I do right now?
Check your rclone version and either upgrade to a fixed version or restrict S3 access to authenticated users only.
Has an official fix been released?
No official fix has been published yet. Monitor the primary sources for updates.