Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-88015: rclone local can crash when handling bad range request

CVE-2026-88015 · published 1 month ago

Summary

The rclone command‑line tool, when used with the local file backend and the option to follow symlinks, can stop responding if an attacker sends a specially crafted HTTP or WebDAV request. This causes a temporary denial of service for anyone trying to access files through rclone’s web interface. Upgrade to rclone version 1.75.1 or later to fix the problem.

What to do

Update github.com rclone to version 1.75.1.
Update rclone github.com/rclone/rclone to version 1.75.1.
Update rclone to version 1.75.1.
Update rclone rclone to version 1.75.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	rclone	rclone	< 1.75.1
go	github.com	rclone	<= 1.75.0 Fix: upgrade to 1.75.1
Debian:12	debian	rclone	All versions
Ubuntu:18.04:LTS	canonical	rclone	All versions
Go	rclone	github.com/rclone/rclone	< 1.75.1 Fix: upgrade to 1.75.1
Bitnami	–	rclone	< 1.75.1 Fix: upgrade to 1.75.1

Original advisory text

rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

References

https://www.cve.org/CVERecord?id=CVE-2026-88015 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-88015 Vendor Advisory
https://ubuntu.com/security/CVE-2026-88015 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88015... Vendor Advisory
https://github.com/rclone/rclone/releases/tag/v1.75.1 URL
https://github.com/rclone/rclone Product
https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw Third Party Advisory
https://github.com/advisories/GHSA-p6m2-r3w9-mpxw
https://nvd.nist.gov/vuln/detail/CVE-2026-88015 Vendor Advisory
https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9 Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-190Integer Overflow

CWE-248Uncaught Exception

Timeline

Published10 Sep 2026

Updated4 Nov 2026

First seen10 Sep 2026

Sources

CVE-2026-88015 · NVD

CVE-2026-88015 · MITRE

GHSA-p6m2-r3w9-mpxw · GHSA

DEBIAN-CVE-2026-88015 · OSV

UBUNTU-CVE-2026-88015 · OSV

CVE-2026-88015 · OSV

GO-2026-6461 · OSV

GHSA-p6m2-r3w9-mpxw · OSV

BIT-rclone-2026-88015 · OSV

Track software like this

Free during beta