CVE-2026-88015 rclone CVE debrief

Who should care

Defenders responsible for managing and maintaining rclone installations should assess their exposure and take necessary actions to prevent exploitation. This includes verifying rclone versions and upgrading to 1.75.1 if necessary, reviewing and adjusting rclone configuration, and monitoring rclone logs for potential attacks.

Why it matters

A denial-of-service vulnerability exists in rclone versions prior to 1.75.1, which can be triggered by providing a Range start larger than the target length of a symlink. Defenders should prioritize verifying their rclone versions and upgrading to 1.75.1 if necessary.

• Potential denial-of-service condition
• Need to verify rclone version and upgrade to 1.75.1 if necessary
• Possible impact on data availability

Technical summary

The vulnerability exists in the local backend of rclone when using the --links or links=true option. An attacker can trigger a panic by providing a Range start larger than the target length of a symlink, leading to a denial-of-service condition. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process.

Defensive priority

Defenders should prioritize verifying their rclone versions and upgrading to 1.75.1 if necessary.

Recommended defensive actions

• Verify rclone version and upgrade to 1.75.1 if necessary
• Review and adjust rclone configuration to prevent exploitation
• Monitor rclone logs for potential attacks
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is caused by a lack of input validation in the fs.RangeOption.Decode function, which allows an attacker to pass an unchecked positive Range start through Object.Open and openTranslatedLink. This can lead to a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. The panic can be triggered by providing a Range start larger than the target length of a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.