CVE-2026-71310: rclone memory exhaustion via unbounded HTTP CONNECT response headers

Executive brief

rclone is a command-line program used to manage and sync files on various cloud storage providers. A vulnerability in how it handles proxy connections allows a malicious or compromised proxy server to send an unlimited amount of data during the initial connection phase. This can cause rclone to consume all available system memory, leading to a crash that disrupts file transfers and other active operations.

Technical details

The vulnerability exists in the `HTTPConnectDial` helper within `lib/proxy/http.go`, which uses `http.ReadResponse` over an unrestricted buffered reader. Unlike standard HTTP transports, this implementation does not enforce a `MaxResponseHeaderBytes` limit or a handshake deadline. A malicious proxy or an on-path attacker (in plaintext scenarios) can send extremely large HTTP CONNECT response headers, leading to process-wide memory exhaustion (OOM). This affects backends that utilize this helper, such as SFTP and FTP. The issue is addressed in version 1.75.0 by enforcing a budget on CONNECT status and header sizes.

Affected products

• rclone rclone <= 1.74.0

Timeline

• 2026-07-31: disclosed
• 2026-07-31: patched: Fixed in version 1.75.0
• 2026-08-05: advisory

References

• https://api.github.com/users/cyberlanc3r
• https://github.com/cyberlanc3r
• https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D
• https://api.github.com/users/cyberlanc3r/repos
• https://avatars.githubusercontent.com/u/216992819?v=4
• https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D