GO-2026-6183None▾ SunlitNil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mounts.
github.com/rclone/rclone < 1.75.0Upgrade to a patched release:
github.com/rclone/rclone 1.75.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-79778Medium· 5.3rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors
GHSA-3x6r-wxxg-53vvMedium· 5.3rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
CVE-2026-79779Medium· 5.3rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects
CVE-2026-79777Low· 2.7rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur
CVE-2026-79780Medium· 5.3rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes
GO-2026-6197NoneWebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone