CVSS 4.0
6.0 mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2026-79778
Medium (6.0). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/rclone/rclone 1.75.0.
rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.
Severity
CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWE
- CWE-248
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3x6r-wxxg-53vv | Go | github.com/rclone/rclone | <1.75.0 | 1.75.0 |
| GO-2026-6183 | Go | github.com/rclone/rclone | <1.75.0 | 1.75.0 |