Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-05T20:17:14 github.com/rclone/rclone: rclone: Denial of Service via unbounded HTTP CONNECT response headers 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

A flaw was found in rclone. A remote attacker, by controlling a malicious or compromised proxy server or acting as an on-path attacker for a plaintext HTTP proxy connection, could send oversized HTTP CONNECT response headers. The rclone application's HTTP CONNECT helper processes these responses using an unrestricted buffered reader, leading to unbounded memory growth. This can cause the rclone process to exhaust its memory and terminate, resulting in a Denial of Service (DoS). This vulnerability affects FTP and SFTP proxy connections, with SFTP being vulnerable even before SSH server authentication.

This Moderate impact denial of service flaw in rclone arises from unbounded memory growth when processing oversized HTTP CONNECT response headers via FTP or SFTP proxy connections. Exploitation requires a malicious or compromised proxy server, or an active on-path attacker, which limits the attack vector and increases attack complexity. Avoid routing rclone FTP or SFTP connections through untrusted HTTP proxies. If a proxy is required, ensure it is a trusted, internally controlled endpoint. No mitigation is needed for deployments that do not use HTTP proxies for rclone connections. Red Hat Advanced Cluster Management for Kubernetes 2 Fix deferred rhacm2/volsync-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-71310 https://nvd.nist.gov/vuln/detail/CVE-2026-71310 https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b https://github.com/rclone/rclone/releases/tag/v1.75.0 https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr