CVE-2026-79778: rclone before v1.75.0 Denial of Service via TUS nil-response panic
rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using rclone before v1.75.0 that perform WebDAV TUS uploads to a configured endpoint are exposed. The endpoint must be malicious or compromised and able to reset connections during an upload.
Does an attacker need credentials or direct access to the rclone process?
No privileges are required according to the supplied vector, but user interaction is required. Exploitation relies on rclone being directed to use the affected TUS upload path with an endpoint that can disrupt the connection.
What is the operational impact of successful exploitation?
The nil-response panic can terminate unrecovered goroutines and halt unrelated work in long-lived rclone processes. The reported impact is denial of service; no confidentiality or integrity impact is indicated.
What should teams do if they cannot immediately upgrade?
Avoid performing WebDAV TUS uploads against untrusted endpoints, and investigate whether configured endpoints could be compromised or capable of resetting upload connections. The provided data identifies v1.75.0 as the version boundary for the affected condition.