CVE-2026-71310: rclone DoS Vulnerability

CVE-2026-71310 Overview

CVE-2026-71310 is a resource exhaustion vulnerability in rclone, the widely used command-line tool for syncing files between cloud storage providers. The flaw resides in the shared HTTP CONNECT helper at lib/proxy/http.go, which parses proxy CONNECT responses using http.ReadResponse over an unrestricted buffered reader. A malicious or compromised proxy, or an on-path attacker controlling a plaintext HTTP proxy hop, can send oversized headers that grow memory until the rclone process crashes. The helper serves FTP and SFTP proxy connections, and SFTP invokes the parser before SSH server authentication. Target host key validation therefore does not restrict a malicious proxy. The issue is fixed in rclone 1.75.0.

Critical Impact
Attackers controlling a proxy hop can exhaust rclone process memory, causing denial of service against file synchronization workflows.

Affected Products

rclone versions prior to 1.75.0
FTP backend using HTTP proxy configuration
SFTP backend using HTTP proxy configuration

Discovery Timeline

2026-08-05 - CVE-2026-71310 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71310

Vulnerability Analysis

The vulnerability is categorized as uncontrolled resource consumption [CWE-400]. rclone's proxy helper establishes tunneled connections by issuing an HTTP CONNECT request and reading the proxy response with http.ReadResponse. The reader passed to that call is not bounded, so response headers can grow arbitrarily large. An attacker feeds header data continuously, forcing rclone to buffer bytes into memory until the operating system terminates the process or the host becomes unresponsive.

The helper is shared across the FTP and SFTP backends. For SFTP, the vulnerable parser executes before the SSH handshake authenticates the target server. Host key pinning and known_hosts validation therefore provide no defense, because the exhaustion occurs during proxy negotiation.

Root Cause

The root cause is the absence of a size limit on the bufio.Reader supplied to http.ReadResponse. Go's standard library does not enforce a default cap on header length when the caller controls the reader. Without an explicit io.LimitReader or MaxHeaderBytes equivalent, header parsing continues indefinitely.

Attack Vector

Exploitation requires an attacker to control a proxy configured in rclone or to sit on-path across a plaintext HTTP proxy hop. The attacker responds to the CONNECT request with a valid status line followed by an unbounded stream of header bytes. No authentication is required, and no user interaction is involved once the sync operation begins.

// Patch import added in lib/proxy/http.go
 	"crypto/tls"
 	"encoding/base64"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"net/url"

Source: rclone commit 21d8cd3b. The patch introduces the io package to wrap the proxy response reader with a bounded limit, preventing unbounded header accumulation.

Detection Methods for CVE-2026-71310

Indicators of Compromise

Rapid memory growth in rclone processes coinciding with FTP or SFTP sync operations routed through an HTTP proxy.
rclone processes terminated by the OOM killer during proxy CONNECT negotiation.
Anomalously large HTTP response header sizes originating from configured proxy endpoints.

Detection Strategies

Monitor rclone process resident set size (RSS) growth patterns and alert on sudden multi-gigabyte spikes.
Inspect network traffic to configured proxies for CONNECT responses exceeding typical header sizes (>16 KB).
Correlate rclone crash events with proxy configuration changes or newly added proxy endpoints.

Monitoring Recommendations

Enable verbose rclone logging with --log-level DEBUG during proxy-mediated transfers to capture CONNECT response metadata.
Aggregate host memory metrics and OOM killer events in a centralized log store for correlation with rclone activity.
Track the rclone binary version deployed across hosts and flag any version below 1.75.0.

How to Mitigate CVE-2026-71310

Immediate Actions Required

Upgrade rclone to version 1.75.0 or later on all hosts running FTP or SFTP transfers through a proxy.
Audit rclone configurations for proxy settings on FTP and SFTP remotes and validate proxy endpoint trustworthiness.
Eliminate plaintext HTTP proxy hops and replace them with HTTPS proxies to prevent on-path header injection.

Patch Information

The fix is available in rclone v1.75.0. Full technical details are documented in GitHub Security Advisory GHSA-xhf4-832v-7xcr, and the code change is available in the upstream commit.

Workarounds

Remove proxy configuration from FTP and SFTP remotes where feasible until upgrading is possible.
Restrict rclone process memory using cgroup limits or systemd MemoryMax directives to contain exhaustion attempts.
Route proxy traffic exclusively through trusted TLS-terminated endpoints to eliminate on-path tampering.

bash

# Verify rclone version meets the patched release
rclone version | head -n 1

# Constrain rclone memory with systemd until patched
systemd-run --scope -p MemoryMax=512M rclone sync source: dest: