CVE-2026-71310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71310", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-05T18:14:42.063Z", "datePublished": "2026-08-05T20:17:14.858Z", "dateUpdated": "2026-08-31T14:53:51.616Z"}, "containers": {"cna": {"title": "rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr"}, {"name": "https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b"}, {"name": "https://github.com/rclone/rclone/releases/tag/v1.75.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"}, {"name": "https://pkg.go.dev/vuln/GO-2026-6199", "tags": ["x_refsource_MISC"], "url": "https://pkg.go.dev/vuln/GO-2026-6199"}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"version": "< 1.75.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-31T14:53:51.616Z"}, "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0."}], "source": {"advisory": "GHSA-xhf4-832v-7xcr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T13:47:26.826525Z", "id": "CVE-2026-71310", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:47:34.279Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71310", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:47:26.826525Z"}}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:47:03.718Z"}}], "cna": {"title": "rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory", "source": {"advisory": "GHSA-xhf4-832v-7xcr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": "< 1.75.0"}]}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr", "name": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b", "name": "https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rclone/rclone/releases/tag/v1.75.0", "name": "https://github.com/rclone/rclone/releases/tag/v1.75.0", "tags": ["x_refsource_MISC"]}, {"url": "https://pkg.go.dev/vuln/GO-2026-6199", "name": "https://pkg.go.dev/vuln/GO-2026-6199", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-31T14:53:51.616Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71310", "state": "PUBLISHED", "dateUpdated": "2026-08-31T14:53:51.616Z", "dateReserved": "2026-08-05T18:14:42.063Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-05T20:17:14.858Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rclone", "vendor": "rclone", "versions": [{"status": "affected", "version": "< 1.75.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0."}], "id": "CVE-2026-71310", "lastModified": "2026-09-09T20:50:00.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71310", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T13:47:26.826525Z", "version": "2.0.3"}}]}, "published": "2026-08-05T21:16:58.573", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/releases/tag/v1.75.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr"}, {"source": "security-advisories@github.com", "url": "https://pkg.go.dev/vuln/GO-2026-6199"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: Denial of Service via unbounded HTTP CONNECT response headers", "id": "2511772", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511772"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in rclone. A remote attacker, by controlling a malicious or compromised proxy server or acting as an on-path attacker for a plaintext HTTP proxy connection, could send oversized HTTP CONNECT response headers. The rclone application's HTTP CONNECT helper processes these responses using an unrestricted buffered reader, leading to unbounded memory growth. This can cause the rclone process to exhaust its memory and terminate, resulting in a Denial of Service (DoS). This vulnerability affects FTP and SFTP proxy connections, with SFTP being vulnerable even before SSH server authentication."], "mitigation": {"lang": "en:us", "value": "Avoid routing rclone FTP or SFTP connections through untrusted HTTP proxies. If a proxy is required, ensure it\nis a trusted, internally controlled endpoint. No mitigation is needed for deployments that do not use HTTP proxies for rclone connections."}, "name": "CVE-2026-71310", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-05T20:17:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-71310\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71310\nhttps://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b\nhttps://github.com/rclone/rclone/releases/tag/v1.75.0\nhttps://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr"], "statement": "This Moderate impact denial of service flaw in rclone arises from unbounded memory growth when processing oversized HTTP CONNECT response headers via FTP or SFTP proxy connections. Exploitation requires a malicious or compromised proxy server, or an active on-path attacker, which limits the attack vector and increases attack complexity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.75.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-08-05T21:30:16.208210+00:00", "updated": "2026-08-05T22:00:14.920227+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}