CVE-2026-71310 Details
Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.
A memory exhaustion vulnerability has been identified in Rclone, a command-line tool for syncing files with cloud storage. This issue arises in versions prior to 1.75.0, where the HTTP CONNECT proxy response is parsed without proper restrictions. A malicious or compromised proxy, or an active on-path actor controlling a plaintext HTTP proxy, can send oversized headers that overwhelm the memory, causing the Rclone process to fail. This vulnerability affects FTP and SFTP proxy connections, with SFTP being particularly vulnerable as it reaches the parser before SSH authentication, allowing a malicious proxy to exploit the issue without detection.
Users can update to Rclone version 1.75.0, which addresses this vulnerability by imposing a 1MB limit on the size of CONNECT response headers. The updated version is available on the Rclone GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 31, 2026 | CVE Modified | [email protected] |
| Aug 31, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |