Executive brief
rclone is a popular command-line tool for syncing files to cloud storage and serving local directories over HTTP/WebDAV. When configured to expose symlinks as objects (--links flag), a remote attacker can send a single crafted HTTP Range request to crash the request handler, making the service unavailable for that connection. No authentication is required and the attack is fully deterministic.
Technical details
The vulnerability exists in rclone's backend/local module when the `--links` flag is enabled, exposing symlinks as rclone objects. The `Object.Open()` method decodes an incoming HTTP Range header (e.g., `Range: bytes=9223372036854775807-`) without properly validating the offset parameter before passing it to `openTranslatedLink()`. That function then attempts to slice a string with the unchecked offset: `linkdst[offset:]`, causing a runtime panic when offset exceeds the string length. The suffix-range branch (`bytes=-N`) already included bounds-clamping logic from a prior fix, but the ordinary range branch (`bytes=X-`) was never hardened. The fix clamps the offset to the target string's length before slicing. The vulnerability requires the `--links` flag to be active and the attacker must reach the HTTP server (network accessible), but no privileges or user interaction are needed.
Affected products
- rclone rclone <= 1.75.0
Timeline
- 2026-09-04: disclosed
- 2026-09-10: patched: Fixed in rclone v1.75.1