{"id":"EUVD-2026-65536","revision":null,"records":[{"revision":"00c730d226454492971561c742eba253","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79778","aliases":[],"title":"rclone before v1.75.0 Denial of Service via TUS nil-response panic","description":"rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.","state":0,"publishedAt":"2026-08-25T15:16:08.402+00:00","modifiedAt":"2026-08-25T16:12:58.686+00:00","affected":[{"ecosystem":"Vendor product","name":"rclone","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rclone\",\n                    \"product\": \"rclone\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/rclone/rclone\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"1.75.0\"\n                        },\n                        {\n                            \"version\": \"1.75.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv","https://www.vulncheck.com/advisories/rclone-before-denial-of-service-via-tus-nil-response-panic"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79778","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79778","identifiers":["CVE-2026-79778"]},"retained":false,"historicalAffected":[]},{"revision":"f7641c46750a46f5a377fe6c5e012357","observedAt":"2026-11-11T16:09:55.411+00:00","statement":{"source":"euvd","id":"EUVD-2026-65536","aliases":["CVE-2026-79778","GHSA-hqc5-cqqv-7gwf"],"title":"rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections …","description":"rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6,"severity":null}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv","https://www.vulncheck.com/advisories/rclone-before-denial-of-service-via-tus-nil-response-panic"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65536","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 25, 2026, 3:16:08 PM","dateUpdated":"Aug 25, 2026, 4:12:58 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-65536","identifiers":["EUVD-2026-65536","CVE-2026-79778","GHSA-hqc5-cqqv-7gwf"]},"retained":false,"historicalAffected":[]},{"revision":"979f84df7ae24dc79b4eaffc822d48e2","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-79778","aliases":[],"title":"rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections …","description":"rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.","state":0,"publishedAt":"2026-08-25T16:17:29.657+00:00","modifiedAt":"2026-09-10T20:46:19.78+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv","https://www.vulncheck.com/advisories/rclone-before-denial-of-service-via-tus-nil-response-panic"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79778","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-248"],"productCriteria":[],"sourceDates":{"published":"2026-08-25T16:17:29.657","lastModified":"2026-09-10T20:46:19.780"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-79778","identifiers":["CVE-2026-79778"]},"retained":false,"historicalAffected":[]},{"revision":"11c15430f34949408c069d7e5874ec33","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-3x6r-wxxg-53vv","aliases":["BIT-rclone-2026-79778","CVE-2026-79778","GO-2026-6183"],"title":"rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic","description":"## 1. Summary\n\nA transport failure during the initial Infinite Scale TUS creation POST can return `(nil response, non-nil error)`. Rclone dereferences the nil response before processing the error and panics. The production `CreateUploader` path reproduced the crash against a closed endpoint.\n\nThe security case is deployment-dependent. A one-shot upload already fails when its endpoint resets, while RC jobs recover panics in `fs/rc/jobs/job.go` and return a job error. The incremental denial of service is strongest in a long-lived VFS mount or concurrent/multi-remote CLI process where the upload runs in an unrecovered goroutine and the panic terminates unrelated work.\n\n## 2. Affected Assets & Attack Surface\n\n- Verified rclone revision: `a0c09f1381ae93e2a9a33c529d170186c61ad058` (`v1.74.0-240-ga0c09f138`)\n- Current-master check: `backend/webdav/tus.go` was unchanged at master commit `961266888fe797390c535386f3b3aa46f4853602` on 2026-07-18\n- Response evaluation: `backend/webdav/tus.go:45-59`\n- Creation path: `backend/webdav/tus.go:61-107`\n- Unrecovered VFS caller: `vfs/write.go:71-81`\n- Contained RC caller: `fs/rc/jobs/job.go:107-115`\n- Configuration: Infinite Scale WebDAV uploads using TUS\n- Code triggers: any pre-response transport failure, including refusal, reset, timeout, DNS/TLS/proxy failure, or cancellation\n- Security trigger: a malicious/compromised configured endpoint resets an upload in a long-lived or multi-workload process\n\n## 3. Technical Root Cause Analysis\n\n`getTusLocationOrRetry` switches on `resp.StatusCode` before checking whether `resp` is nil or handling the accompanying error. A nil response is valid when the HTTP transaction fails before a response is parsed. There is no recovery boundary in the WebDAV operation itself. Whether the panic is process-fatal depends on its caller: the VFS write path starts `operations.Rcat` in an unrecovered goroutine (`vfs/write.go:71-81`), whereas RC jobs wrap their function in `recover` (`fs/rc/jobs/job.go:107-115`).\n\n## 4. Proof-of-Concept & Evidence\n\n1. Configure the actual Infinite Scale creation path to a closed local endpoint.\n2. Invoke `Object.CreateUploader`.\n3. The POST returns a transport error and no response.\n4. `getTusLocationOrRetry` dereferences `resp.StatusCode` and panics.\n\nA remote endpoint can produce the same `(nil response, non-nil error)` state by accepting and resetting the connection before returning an HTTP response. TLS prevents arbitrary response modification but does not prevent the configured endpoint from closing or resetting its own connection. Refusal, DNS, TLS, proxy, and cancellation failures exercise the code defect but do not by themselves identify a remote security actor.\n\n## 5. Impact Assessment\n\nIn an unrecovered CLI or VFS upload goroutine, the panic terminates the rclone process and any unrelated work it hosts. A hostile configured endpoint can repeat the condition whenever the victim initiates a TUS upload. RC jobs are excluded from the process-wide impact because their execution boundary recovers the panic and records an error. In a one-shot process dedicated to the hostile endpoint, the incremental security impact over an ordinary transport error is limited.\n\n## 6. Remediation Guidance\n\n- Check `resp == nil` before accessing response fields.\n- Pass transport errors through the existing retry policy and return a normal error after exhaustion.\n- Test refusal, reset, timeout, DNS, TLS, proxy, and cancellation paths.\n- Add panic containment to long-lived worker goroutines as defense in depth; keep nil handling as the primary fix.","state":0,"publishedAt":"2026-08-05T20:26:07+00:00","modifiedAt":"2026-09-25T14:25:57.5276446+00:00","affected":[{"ecosystem":"Go","name":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.75.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv","https://github.com/rclone/rclone/commit/5871d98c368751a6d992ed64f8cd22cb78c44cee","https://github.com/rclone/rclone","https://github.com/rclone/rclone/releases/tag/v1.75.0"],"sourceUrl":"https://github.com/advisories/GHSA-3x6r-wxxg-53vv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3x6r-wxxg-53vv","identifiers":["GHSA-3x6r-wxxg-53vv","BIT-rclone-2026-79778","CVE-2026-79778","GO-2026-6183"]},"retained":false,"historicalAffected":[]},{"revision":"6e212ee9462d457ca2818648cdb53b33","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6183","aliases":["BIT-rclone-2026-79778","CVE-2026-79778","GHSA-3x6r-wxxg-53vv"],"title":"Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone","description":"During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mounts.","state":0,"publishedAt":"2026-08-18T16:38:10+00:00","modifiedAt":"2026-09-25T14:25:57.5276446+00:00","affected":[{"ecosystem":"Go","name":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.75.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv","https://github.com/rclone/rclone/commit/5871d98c368751a6d992ed64f8cd22cb78c44cee","https://github.com/rclone/rclone/releases/tag/v1.75.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6183","license":"OSV · upstream source license applies","key":"osv:GO-2026-6183","identifiers":["GO-2026-6183","BIT-rclone-2026-79778","CVE-2026-79778","GHSA-3x6r-wxxg-53vv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T10:55:30.8237330+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T10:55:30.823733+00:00","lastSuccessAt":"2026-11-12T10:55:31.0556782+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:55:31.055679+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-597d2a846bb8b004ef04143ee27b4f2061367ce1f574db03c0eec66ce3f0654b","complete":true,"records":424644,"lastAttemptAt":"2026-11-12T10:53:33.7939567+00:00","lastSuccessAt":"2026-11-12T10:53:33.7645522+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:53:33.7939567+00:00","snapshotPublishedAt":"2026-11-12T10:28:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9db698e4659747149ec1092e3d34a5a1","complete":true,"records":13764,"lastAttemptAt":"2026-11-12T10:56:11.9015763+00:00","lastSuccessAt":"2026-11-12T09:56:01.656+00:00","error":null,"lastVerifiedAt":"2026-11-12T09:56:01.656+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13817,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T10:55:30.8237330+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T10:55:30.823733+00:00","lastSuccessAt":"2026-11-12T10:55:31.0564011+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:55:31.0564012+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bd366c4173b74364bb995788ecd92c36","complete":false,"records":13764,"lastAttemptAt":"2026-11-12T10:56:10.5374387+00:00","lastSuccessAt":"2026-11-12T10:56:10.532+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:56:10.532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13313,"expectedIdentifiers":13817,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T10:55:30.6813009+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:55:30.6813009+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T10:53:33.9269183+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:53:33.9269183+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f46f74c6a30a9b6e4cfb481719c6d35521ebec2d53ebf163223d093ae587eb9d","complete":true,"records":3106,"lastAttemptAt":"2026-11-12T10:55:30.7817941+00:00","lastSuccessAt":"2026-11-12T09:55:31.1176285+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:55:30.7817941+00:00","snapshotPublishedAt":"2026-11-12T09:48:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-cafddcfb656ee3e2c62171513201ded79d8731137bd7467a5e566349080db7d4","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T10:55:30.5507315+00:00","lastSuccessAt":"2026-11-12T10:55:29.0211827+00:00","error":null,"lastVerifiedAt":"2026-11-12T10:55:30.5507315+00:00","snapshotPublishedAt":"2026-11-12T10:33:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}