rclone NULL pointer dereference in WebDAV TUS upload

Executive brief

rclone is a command-line program used to manage and sync files on various cloud storage providers. A vulnerability in how it handles certain web-based file uploads (TUS) can cause the entire application to crash if the storage server sends an unexpected response or disconnects abruptly. This can lead to a denial of service, where ongoing file transfers or background sync tasks are terminated unexpectedly.

Technical details

A null pointer dereference exists in rclone's WebDAV backend, specifically within the TUS (Resumable Uploads) implementation. The function `getTusLocationOrRetry` attempts to access the `StatusCode` field of an HTTP response object before verifying if the response is nil. In scenarios where a transport failure occurs (such as a connection reset, timeout, or DNS failure) during the initial TUS creation POST request, the HTTP client returns a nil response and a non-nil error. Because rclone dereferences the nil response before error handling, the process panics. This is particularly impactful in long-lived VFS mounts or multi-remote CLI processes where the panic occurs in an unrecovered goroutine, terminating the entire process. The issue is fixed in version 1.75.0.

Affected products

• rclone rclone <= 1.74.0

Timeline

• 2026-07-31: patched: Fixed in version 1.75.0
• 2026-08-05: disclosed: GitHub Advisory published

References

• https://api.github.com/users/cyberlanc3r
• https://github.com/cyberlanc3r
• https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D
• https://api.github.com/users/cyberlanc3r/repos
• https://avatars.githubusercontent.com/u/216992819?v=4
• https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D