Vulnerability · Published Aug 5, 2026 · Assigned by GitHub_M
CVE-2026-71310rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in rclone from rclone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rclone | no fix listed | DEBIAN-CVE-2026-71310 |
| Debian:13 | rclone | no fix listed | DEBIAN-CVE-2026-71310 |
| Go | github.com/rclone/rclone | 1.75.0 | GHSA-xhf4-832v-7xcr |
| Go | github.com/rclone/rclone | 1.75.0 | GO-2026-6199 |
| Ubuntu:26.10 | rclone | no fix listed | UBUNTU-CVE-2026-71310 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr x_refsource_CONFIRM
- https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b x_refsource_MISC
- https://github.com/rclone/rclone/releases/tag/v1.75.0 x_refsource_MISC
- https://pkg.go.dev/vuln/GO-2026-6199 x_refsource_MISC