CVE-2026-79775: rclone Archive Backend SquashFS Parser Denial of Service
rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rclone (archive backend SquashFS parser)to a version that resolves this vulnerability.Fixed in 1.75.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
rclone versions v1.72.0 through v1.74.4 are affected when they use an :archive: remote that can expose SquashFS images an attacker can place or modify. The impact can extend to the entire service when the affected archive is accessed through rclone serve sftp.
What must an attacker do to trigger the denial of service?
The attacker needs the ability to place or alter a SquashFS image in storage exposed through the :archive: remote. Exploitation is triggered only when a victim or remote client addresses or descends into the malicious archive, because parsing is lazy.
What happens when a malicious archive is accessed?
Malformed superblock or metadata values can cause a division-by-zero panic or an out-of-bounds slice panic that terminates rclone; under rclone serve sftp, this can crash the SFTP server. A truncated metadata stream can instead cause a non-progress loop with sustained CPU consumption.
What is the available remediation?
Upgrade to rclone v1.75.0, which fixes the affected versions. If upgrading cannot happen immediately, avoid exposing attacker-writable or attacker-modifiable SquashFS images through :archive: remotes and prevent clients from browsing untrusted archive objects.