Executive brief
rclone is a widely-used file synchronization and cloud storage tool that supports uploading files to WebDAV endpoints using the TUS protocol. A flaw in the TUS creation handler causes rclone to crash when a WebDAV endpoint resets connections during upload initialization. An attacker controlling or compromising the configured WebDAV endpoint can repeatedly trigger this crash, disrupting long-lived processes like VFS mounts or multi-remote CLI operations where the upload runs in unrecovered threads.
Technical details
The vulnerability is a null-pointer dereference in the getTusLocationOrRetry function (backend/webdav/tus.go:45-59) that checks response.StatusCode before validating that the HTTP response is non-nil. When a transport error occurs during TUS creation POST (connection reset, timeout, DNS failure, TLS error, or proxy failure), the HTTP client returns (nil response, non-nil error). The code dereferences the nil response and panics. In VFS write paths (vfs/write.go:71-81), the panic occurs in an unrecovered goroutine and terminates the entire rclone process; RC jobs recover the panic and return an error instead. Attack preconditions: the attacker must control or compromise the configured WebDAV endpoint and initiate a TUS upload (e.g., by invoking Object.CreateUploader). The fix was released in v1.75.0 by checking resp == nil before accessing response fields and passing transport errors through the retry policy.
Affected products
- rclone rclone before v1.75.0
Timeline
- 2026-07-31: disclosed: GitHub Security Advisory GHSA-3x6r-wxxg-53vv published
- 2026-08: patched: Fix released in v1.75.0
- 2026-08-25: advisory