{"id":"EUVD-2026-75575","enisaUuid":"2f0d5555-2d83-3d39-85ca-d13bf0792656","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links\u003dtrue exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.","datePublished":"Sep 10, 2026, 3:50:41 PM","dateUpdated":"Sep 10, 2026, 4:01:48 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\nhttps://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9\nhttps://github.com/rclone/rclone/releases/tag/v1.75.1\n","aliases":"CVE-2026-88015\nGHSA-p6m2-r3w9-mpxw\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"2d0f8f8b-97ae-3b1a-ba92-9347ff6b398d","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"\u003c 1.75.1"}],"enisaIdVendor":[{"id":"6a7f64ae-24b4-39e2-9990-152f5d994ac9","vendor":{"name":"rclone"}}],"enisaIdVulnerability":[{"id":"504fa4cb-68a0-34b3-95e5-09b3e64ee5f2","vulnerability":{"id":"CVE-2026-88015","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links\u003dtrue exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.","datePublished":"Sep 10, 2026, 3:50:41 PM","dateUpdated":"Sep 10, 2026, 4:01:48 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\nhttps://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9\nhttps://github.com/rclone/rclone/releases/tag/v1.75.1\n","enisa_id":"EUVD-2026-75575\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 11, 2026, 7:19:27 AM","vulnerabilityProduct":[{"id":"95db0155-2e91-3ade-bca2-204d8994191c","product":{"name":"rclone","vendor":{"name":"rclone"}},"product_version":"\u003c 1.75.1"}],"vulnerabilityVendor":[{"id":"6e2ccd60-e2df-3c46-b4ad-6e7f3d0322c7","vendor":{"name":"rclone"}}]}},{"id":"678d968f-9e68-34ca-8017-96c96697b12f","vulnerability":{"id":"GHSA-p6m2-r3w9-mpxw","description":"rclone local: crafted Range request against a translated symlink panics (DoS)","datePublished":"Sep 10, 2026, 10:49:27 PM","dateUpdated":"Sep 10, 2026, 10:49:27 PM","baseScore":0.0,"references":"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88015\nhttps://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9\nhttps://github.com/rclone/rclone\nhttps://github.com/rclone/rclone/releases/tag/v1.75.1\n","enisa_id":"EUVD-2026-75575\n","aliases":"CVE-2026-88015\nGHSA-p6m2-r3w9-mpxw\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:05 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}