CVE-2026-88015: rclone local: crafted Range request against a translated symlink panics (DoS)
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the rclone local backend with --links or links=true are affected when .rclonelink objects are exposed through rclone's HTTP or WebDAV serving functionality. Versions prior to 1.75.1 are affected.
What does an attacker need to do to trigger the failure?
An attacker needs network access to the HTTP or WebDAV service and must request a translated symlink object using a positive Range start greater than the symlink target string length. No authentication or user interaction is indicated by the supplied severity vector.
Will this terminate the entire rclone service?
Normally, Go net/http recovers the panic on a per-connection basis. The expected impact is request-level denial of service rather than termination of the entire process.
What is the remediation?
Upgrade rclone to version 1.75.1, which fixes the unchecked Range start handling.