CVE-2026-79778 rclone CVE debrief

Who should care

Defenders responsible for rclone deployments, particularly those using WebDAV TUS, should assess their exposure and prioritize verification and potential upgrades. They should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-79778 because it affects rclone versions before v1.75.0, potentially allowing malicious endpoints to cause denial of service. Verification of rclone versions, assessment of exposure, and implementation of compensating controls are necessary.

• Potential service disruption due to denial of service
• Need for verification of rclone version and exposure to untrusted endpoints
• Potential impact on long-lived processes due to goroutine termination

Technical summary

The vulnerability exists in the WebDAV TUS creation handler of rclone before v1.75.0. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes. The vulnerability can cause service disruption and impact long-lived processes due to goroutine termination. Defenders should prioritize verifying their rclone versions and upgrading to v1.75.0 or later if necessary. They should also assess their exposure to untrusted endpoints and consider implementing compensating controls to mitigate potential impacts.

Defensive priority

Defenders should prioritize verifying their rclone versions and upgrading to v1.75.0 or later if necessary. They should also assess their exposure to untrusted endpoints and consider implementing compensating controls to mitigate potential impacts.

Recommended defensive actions

• Verify rclone version and upgrade to v1.75.0 or later if necessary
• Assess exposure to untrusted endpoints
• Implement compensating controls to mitigate potential impacts
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, requiring verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.