EUVD-2026-65536
GHSA-hqc5-cqqv-7gwf
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via WebDAV with high complexity from the required TUS-enabled Infinite Scale configuration; attacker controls endpoint so no privileges needed; availability-only impact via process-crashing unrecovered panic.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.
AnalysisAI
Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, because getTusLocationOrRetry dereferences resp.StatusCode before checking the accompanying error - crashing the process if it runs as a long-lived VFS mount or multi-workload goroutine without a recovery boundary. An attacker who controls or compromises the configured WebDAV endpoint can trigger the crash by resetting the TCP connection before an HTTP response is returned, halting all unrelated work in the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three co-present conditions: (1) rclone must be configured with a WebDAV remote pointing to an Infinite Scale (ownCloud/OCIS) instance with TUS resumable-upload support enabled - non-TUS WebDAV remotes and non-WebDAV backends are entirely unaffected; (2) the attacker must either control or have compromised the configured WebDAV server endpoint, or occupy a network position able to inject TCP RST packets during the TUS POST handshake (insider, supply-chain compromise, or network MitM); (3) for maximum impact - process-fatal crash affecting unrelated work - rclone must be running as a VFS mount or in a multi-goroutine concurrent mode without a recovery boundary, because RC-mode jobs catch the panic via `recover()` and return a job error instead of crashing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.0 with AC:H and AT:P accurately reflects the non-trivial prerequisites: a specifically configured Infinite Scale WebDAV TUS endpoint plus the ability to control or compromise that endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker controlling or having compromised a WebDAV Infinite Scale endpoint configured in a victim's rclone instance accepts a TUS upload POST connection and immediately resets it at the TCP layer before returning any HTTP response. The rclone `getTusLocationOrRetry` function dereferences the nil response, panics, and - if the process is a VFS mount or concurrent multi-remote operation - crashes the entire rclone process, halting all unrelated pending goroutine work. … |
| Remediation | Upgrade rclone to v1.75.0, which introduces a nil-response guard in `getTusLocationOrRetry` before the `resp.StatusCode` dereference (patch commit 5871d98c368751a6d992ed64f8cd22cb78c44cee; advisory at https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rcl
Path traversal in rclone's serve s3 command (versions before 1.74.4) allows unauthenticated remote attackers to both rea
Unauthenticated credential exposure in rclone before 1.75.0 allows remote attackers to retrieve backend storage secrets
Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentic
Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during s
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today