rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

Source published

5 Aug 2026 20:17:14 UTC

Source modified

31 Aug 2026 14:53:51 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

Source published

Aug 5, 2026, 8:17:14 PM (timezone not stated)

Source modified

Aug 31, 2026, 2:53:51 PM (timezone not stated)

Saved here

13 Nov 2026 17:02:10 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

Source published

5 Aug 2026 21:16:58 UTC

Source modified

9 Sep 2026 20:50:00 UTC

Saved here

25 Oct 2026 15:18:57 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

## 1. Summary The shared HTTP CONNECT helper parses a proxy response with `http.ReadResponse` over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP-proxy hop, can grow memory until the process fails. The security impact is process-wide exhaustion, not loss of access through the malicious proxy, which the proxy already controls. The victim must configure and use the proxy, so UI is Required and the rating is Medium. ## 2. Affected Assets & Attack Surface - Verified rclone revision: `a0c09f1381ae93e2a9a33c529d170186c61ad058` (`v1.74.0-240-ga0c09f138`) - Current-master check: `lib/proxy/http.go` was unchanged at master commit `961266888fe797390c535386f3b3aa46f4853602` on 2026-07-18 - Shared helper: `lib/proxy/http.go:23-81` - SFTP use: `backend/sftp/ssh_internal.go:25-45` - FTP use: `backend/ftp/ftp.go:465-479` - Proxy peer: configured malicious/compromised proxy or active on-path actor for a plaintext HTTP proxy - TLS boundary: HTTPS proxy connections authenticate the proxy before this response is parsed, so an on-path actor must also defeat TLS ## 3. Technical Root Cause Analysis `HTTPConnectDial` invokes `http.ReadResponse(br, req)` directly. This call does not inherit `http.Transport.MaxResponseHeaderBytes`. In the Go implementation used for validation, exported `textproto.Reader.ReadMIMEHeader` passes `math.MaxInt64` limits, and `textproto.NewReader` explicitly instructs callers to use `io.LimitReader` or an equivalent bound for denial-of-service resistance. Rclone supplies no bound or total CONNECT-handshake deadline. The helper additionally returns the raw connection, so a safe remediation must preserve any tunnel bytes already buffered after the CONNECT response. ## 4. Proof-of-Concept & Evidence 1. Configure the helper to use a test proxy. 2. Accept rclone's CONNECT request. 3. Return `HTTP/1.1 200 Connection Established` with an `X-Fill` header containing 2 MiB of data. 4. The actual helper parses and accepts the entire response without a fixed ceiling; this succeeded in all three reruns. The test establishes unbounded parsing behavior without intentionally exhausting the host. ## 5. Impact Assessment Large or concurrent CONNECT responses can terminate the rclone process and interrupt unrelated FTP/SFTP remotes and mounts. Runtime OOM cannot be contained by RC panic recovery. SFTP reaches this parser before SSH server authentication, so target host-key validation does not constrain a malicious proxy; HTTPS proxy authentication does constrain ordinary on-path attackers. ## 6. Remediation Guidance - Enforce a total CONNECT status/header budget before parsing. - Add a fixed total handshake deadline as well as idle deadlines. - Close the connection on an oversized or malformed response. - Return a wrapper that consumes already buffered post-response tunnel bytes before the raw connection. - Test large single/multiple headers, slow streaming, and concurrent handshakes.

Source published

5 Aug 2026 20:17:52 UTC

Source modified

10 Sep 2026 03:51:14 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · MODERATE

Resource exhaustion via unbounded HTTP CONNECT response in github.com/rclone/rclone

Source published

18 Aug 2026 16:38:10 UTC

Source modified

18 Aug 2026 17:23:55 UTC

Saved here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.