Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-88015 BIT-rclone-2026-88015EUVD-2026-75575GHSA-p6m2-r3w9-mpxwGO-2026-6461

rclone local: crafted Range request against a translated symlink panics (DoS)

Published Sep 10, 2026 · Updated Sep 10, 2026 · Assigned by GitHub_M

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Affected products

VendorProductAffectedFixed
rclone rclone < 1.75.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 rclone No fix yet —
Debian 12 rclone No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rclone No fix yet —
Ubuntu 18.04 LTS rclone No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS rclone No fix yet —
Ubuntu Pro 24.04 LTS rclone No fix yet —
Ubuntu Pro 22.04 LTS rclone No fix yet —
Ubuntu Pro 20.04 LTS rclone No fix yet —
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260916T180043-160000.1.1 SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1
SLES 16.0 govulncheck-vulndb 0.0.20260916T180043-160000.1.1 SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260916T180043-160000.1.1 openSUSE-SU-2026:21897-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 rclone 1.75.1-1.amzn2023 ALAS2023-2026-3129

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling telegraf-1.38 1.38.4-r28 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/rclone/rclone < 1.75.1 1.75.1 GHSA-p6m2-r3w9-mpxw

Advisories 4

References