Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-79775: rclone versions up to 1.74.4 can crash or hang
CVE-2026-79775 · published 2 months ago
Summary
Versions of rclone from 1.72.0 through 1.74.4 may stop working or become very slow when they open a specially crafted SquashFS archive file. If an attacker can place such an archive on storage accessed through rclone, the program can exit unexpectedly or consume excessive CPU, affecting file transfers and SFTP services. Update rclone to version 1.75.0 or later and avoid processing untrusted archive files.
What to do
- Update rclone to version 1.75.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | rclone | rclone | <= 1.74.4 |
| Debian:11 | debian | rclone | All versions |
| Debian:12 | debian | rclone | All versions |
| Debian:13 | debian | rclone | All versions |
| Ubuntu:18.04:LTS | canonical | rclone | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | rclone | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | rclone | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | rclone | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | rclone | All versions |
| Bitnami | – | rclone |
>= 1.72.0, < 1.75.0 Fix: upgrade to 1.75.0
|
Original advisory text
rclone Archive Backend SquashFS Parser Denial of Service
rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.
References
- https://www.vulncheck.com/advisories/rclone-archive-backend-squashfs-parser-deni... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-79775 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-79775 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79775... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-79775 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-79775 Third Party Advisory
- https://github.com/rclone/rclone/security/advisories/GHSA-6jcg-q3wp-x2f4 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-129Improper Validation of Array Index
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen25 Aug 2026
Sources
CVE-2026-79775 · NVD
CVE-2026-79775 · MITRE
DEBIAN-CVE-2026-79775 · OSV
UBUNTU-CVE-2026-79775 · OSV
BIT-rclone-2026-79775 · OSV
CVE-2026-79775 · OSV
GHSA-6jcg-q3wp-x2f4 · GHSA
Track software like this
Free during beta