[GHSA] GHSA-2p48-j3qc-rx9f (high) — rclone: S3 multipart declared-length memory exhaustion

GHSA-2p48-j3qc-rx9f Severity: high CVE: CVE-2026-88045

rclone: S3 multipart declared-length memory exhaustion

## Summary

In streamed multipart mode, `serve s3` passes the request's declared part length to `multipart.NewRW().Reserve(contentLength)` before reading any part data. `Reserve` immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore all