CVE-2026-71310 rclone CVE debrief

Who should care

Users of rclone, especially those using FTP and SFTP proxy connections, should verify their version and apply updates if necessary. System administrators and security teams responsible for managing rclone deployments should be aware of this vulnerability and take steps to mitigate it. Additionally, developers and maintainers of rclone should review the code and ensure that similar vulnerabilities are not present in other parts of the project.

Technical summary

rclone's shared HTTP CONNECT helper in lib/proxy/http.go is vulnerable to memory exhaustion via oversized headers in HTTP CONNECT responses. This issue affects FTP and SFTP proxy connections, potentially allowing a malicious proxy to cause the rclone process to fail. The vulnerability is due to the helper parsing proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader. This can lead to memory growth until the rclone process fails. The issue is fixed in version 1.75.0.

Defensive priority

Medium priority due to potential for memory exhaustion via oversized headers in HTTP CONNECT responses.

Recommended defensive actions

• Verify rclone version is 1.75.0 or later
• Restrict proxy connections to trusted sources
• Monitor for unusual memory usage in rclone processes
• Implement compensating controls for FTP and SFTP proxy connections
• Review and update proxy connection configurations to prevent exploitation
• Conduct regular security audits to identify potential vulnerabilities
• Establish a process for rapid response to potential security incidents involving rclone

Evidence notes

Evidence is limited; primary official records indicate a memory exhaustion vulnerability in rclone's HTTP CONNECT helper. Further verification needed. Additional review of proxy connection configurations and memory usage patterns may be necessary to fully assess the vulnerability. Defenders should verify rclone version and configurations, review proxy connection settings, and monitor for unusual memory usage.

Official resources