rclone CVE-2026-79778

Exploitation requires three co-present conditions: (1) rclone must be configured with a WebDAV remote pointing to an Infinite Scale (ownCloud/OCIS) instance with TUS resumable-upload support enabled - non-TUS WebDAV remotes and non-WebDAV backends are entirely unaffected; (2) the attacker must either control or have compromised the configured WebDAV server endpoint, or occupy a network position able to inject TCP RST packets during the TUS POST handshake (insider, supply-chain compromise, or network MitM); (3) for maximum impact - process-fatal crash affecting unrelated work - rclone must be running as a VFS mount or in a multi-goroutine concurrent mode without a recovery boundary, because RC-mode jobs catch the panic via recover() and return a job error instead of crashing. The CVSS 4.0 AC:H and AT:P metrics confirm these prerequisites; exploitation against a default or unconfigured rclone installation is not possible.

The CVSS 4.0 score of 6.0 with AC:H and AT:P accurately reflects the non-trivial prerequisites: a specifically configured Infinite Scale WebDAV TUS endpoint plus the ability to control or compromise that endpoint. Real-world risk is bifurcated by deployment mode - VFS mounts and multi-workload long-lived processes face process-fatal crashes, while RC jobs and one-shot CLI invocations either recover gracefully or simply fail the upload. No EPSS data was included in the source intelligence, and this CVE does not appear in the CISA KEV catalog, together indicating no confirmed opportunistic exploitation. The clean reproducibility of the crash path (the GHSA advisory includes a four-step proof-of-concept) means any team operating automated rclone VFS mounts against WebDAV storage should treat patch deployment as urgent, particularly where the WebDAV remote is externally hosted or shared infrastructure where endpoint compromise is a credible threat. The availability-only impact and high attack complexity place this below critical priority for most organizations, but the potential to halt all unrelated goroutine work in a persistent process elevates it above a trivial denial-of-service to a genuine service-availability event for VFS-mount operators.

An attacker controlling or having compromised a WebDAV Infinite Scale endpoint configured in a victim's rclone instance accepts a TUS upload POST connection and immediately resets it at the TCP layer before returning any HTTP response. The rclone getTusLocationOrRetry function dereferences the nil response, panics, and - if the process is a VFS mount or concurrent multi-remote operation - crashes the entire rclone process, halting all unrelated pending goroutine work. No shellcode or exploit payload is required; a standard TCP RST is the complete trigger.