CVE-2026-79775 rclone CVE debrief

Who should care

Users of rclone versions between v1.72.0 and v1.74.4, especially those exposing rclone :archive: remotes or using 'rclone serve sftp', should be aware of the potential for denial-of-service attacks and take steps to mitigate the risk. This includes upgrading to rclone version v1.75.0 or later, restricting access to rclone :archive: remotes, and monitoring for unusual activity. Security teams and operators managing rclone deployments should prioritize this vulnerability and implement compensating controls to limit potential impact.

Technical summary

rclone versions from v1.72.0 to v1.74.4 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser. The parser fails to validate attacker-controlled superblock and metadata values before use, allowing an attacker to craft malicious SquashFS images that trigger crashes or sustained CPU consumption. This vulnerability is particularly concerning for users exposing rclone :archive: remotes or using 'rclone serve sftp', as it can lead to server crashes or high CPU usage. The vulnerability can be mitigated by upgrading to rclone version v1.75.0 or later.

Defensive priority

Organizations using rclone versions between v1.72.0 and v1.74.4 should prioritize upgrading to v1.75.0 or later to address multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser.

Recommended defensive actions

• Upgrade to rclone version v1.75.0 or later
• Restrict access to rclone :archive: remotes to trusted users
• Monitor rclone logs for unusual activity or crashes
• Implement compensating controls to limit the impact of potential attacks
• Review system configurations for exposed rclone :archive: remotes
• Conduct regular security audits to identify potential vulnerabilities
• Develop an incident response plan for potential denial-of-service attacks

Evidence notes

The CVE record indicates that rclone versions from v1.72.0 to v1.74.4 are vulnerable due to improper validation of SquashFS image metadata. An attacker could exploit this by crafting a malicious SquashFS image that triggers a panic or sustained CPU consumption when processed. Evidence of this vulnerability's existence and impact is grounded in the official CVE Program record and NIST NVD detail page. Defenders should verify the integrity of SquashFS images and restrict access to rclone :archive: remotes to trusted users. Further review of system logs and monitoring for unusual activity is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.