CVE-2026-71310 rclone CVE debrief

Who should care

Defenders and administrators using rclone, especially in environments with FTP and SFTP proxy connections, should assess exposure and verify their version of rclone. They should prioritize verifying their rclone version and upgrading to 1.75.0 if necessary. This is particularly relevant for environments using FTP and SFTP proxy connections, as the vulnerability could lead to memory exhaustion and process failure.

Why it matters

Defenders should care about CVE-2026-71310 because it affects rclone's handling of proxy connections, potentially leading to memory exhaustion and process failure. This issue is particularly relevant for environments using FTP and SFTP proxy connections. The vulnerability was fixed in rclone version 1.75.0, and defenders should verify their rclone version and upgrade if necessary.

• Potential memory exhaustion and process failure in rclone
• Possible disruption of file synchronization operations
• Need for verification of rclone version and upgrade to 1.75.0
• Potential for malicious proxy exploitation

Technical summary

The shared HTTP CONNECT helper in lib/proxy/http.go of rclone, prior to version 1.75.0, could parse oversized proxy CONNECT responses. This could lead to memory exhaustion and process failure when using FTP and SFTP proxy connections. The issue was fixed in version 1.75.0. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. Defenders should prioritize verifying their rclone version and upgrading to 1.75.0 if necessary, especially for environments using FTP and SFTP proxy connections.

Defensive priority

Defenders should prioritize verifying their rclone version and upgrading to 1.75.0 if necessary, especially for environments using FTP and SFTP proxy connections.

Recommended defensive actions

• Verify rclone version and upgrade to 1.75.0 if necessary
• Review and update FTP and SFTP proxy connection configurations
• Monitor rclone process memory usage for potential issues
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while references include commits and releases from rclone's GitHub repository. The shared HTTP CONNECT helper in lib/proxy/http.go of rclone, prior to version 1.75.0, could parse oversized proxy CONNECT responses. This could lead to memory exhaustion and process failure when using FTP and SFTP proxy connections. The issue was fixed in version 1.75.0. Defenders should verify their rclone version and review proxy configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.