CVE catalog

CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 25, 2026

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrclonesid1.75.2-2fixed
Debianrclonetrixie1.60.1+dfsg-4vulnerable
Debianrclonebookworm1.60.1+dfsg-2vulnerable
Gogithub.com/rclone/rcloneNot reported1.75.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrclonesourcesid1.75.2-1not yet assignedNot reported[1143842]
Debianrclonesourcetrixie(unfixed)not yet assignedNot reported[1143842]
Debianrclonesourcebookworm(unfixed)not yet assignedNot reported[1143842]
Gogithub.com/rclone/rclonegoNot reported1.75.0Not reportedGHSA-XHF4-832V-7XCRNot reported

[Debian bug #1143842]

Notes

[trixie] rclone: Minor issue [bookworm] rclone: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-rclone-rclone-dev]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-2 · all · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

    • 1.60.1+dfsg-2 · all · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

  • [rclone]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-2+b5 · amd64 · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

    • 1.60.1+dfsg-2+b5 · arm64 · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-rclone-rclone-dev]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-4 · all · trixie

      Affected

      nvd · rclone · debian · 13

    • 1.60.1+dfsg-4 · all · trixie

      Affected

      nvd · rclone · debian · 13

  • [rclone]Affected
    Details (2)

    • 1.60.1+dfsg-4 · amd64 · trixie

      Affected

      nvd · rclone · debian · 13

    • 1.60.1+dfsg-4 · arm64 · trixie

      Affected

      nvd · rclone · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]