Vulnerability Advisory : rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow with LOW Attack Complexity

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.