CVE-2026-79775: rclone SquashFS Parser DoS Vulnerability

CVE-2026-79775 Overview

CVE-2026-79775 identifies multiple denial-of-service flaws in the rclone archive backend's SquashFS parser. The parser depends on the github.com/diskfs/go-diskfs library and fails to validate attacker-controlled superblock and metadata fields before use. Affected versions span v1.72.0 through v1.74.4, with fixes shipped in v1.75.0. An attacker who can place or modify a SquashFS image reachable through an rclone :archive: remote can craft an image that crashes the process or pins CPU. When paired with rclone serve sftp, the crash terminates the entire SFTP server, extending impact to all connected clients.

Critical Impact
A malicious SquashFS image accessed through an rclone archive remote can crash the rclone process, take down rclone serve sftp, or lock a CPU core indefinitely.

Affected Products

rclone v1.72.0 through v1.74.4
rclone archive backend (:archive: remote)
github.com/diskfs/go-diskfs SquashFS parser dependency

Discovery Timeline

2026-08-25 - CVE-2026-79775 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79775

Vulnerability Analysis

The rclone archive backend lazily parses SquashFS images pulled through an :archive: remote. The parser reads superblock and metadata values from the on-disk structure and uses them directly in arithmetic and slice operations. Because parsing is deferred, exploitation only fires when a victim or remote client addresses or descends into the malicious archive object.

The advisory documents three variants. Variant 1 supplies a zero block size in the superblock, producing an integer division-by-zero panic. Variant 2 supplies an out-of-range inode metadata offset, triggering an out-of-bounds slice panic. Variant 3 supplies a truncated metadata stream that pushes the decoder into a non-progress loop, burning CPU indefinitely.

Variants 1 and 2 terminate the rclone process. When rclone is running as rclone serve sftp, that crash removes SFTP service for every connected client. Variant 3 does not crash the process but drives sustained CPU consumption on the host.

Root Cause

The root cause is missing validation of untrusted numeric inputs [CWE-129]. The SquashFS parser trusts attacker-controlled fields including the block size, inode metadata offsets, and metadata stream length. No bounds checks or sanity checks precede the arithmetic, indexing, or loop operations that consume those values.

Attack Vector

Exploitation requires the attacker to place or modify a SquashFS file inside storage that rclone exposes through an :archive: remote. The attacker also needs a triggering action such as a directory listing, file read, or client-side descent into the archive. In rclone serve sftp deployments, any authenticated SFTP client with access to the archive path can initiate the trigger.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-6jcg-q3wp-x2f4 and the VulnCheck Advisory for the vendor-authored technical breakdown.

Detection Methods for CVE-2026-79775

Indicators of Compromise

Unexpected termination of rclone processes with Go runtime panic traces referencing integer divide by zero or slice bounds out of range in go-diskfs SquashFS code paths.
Sustained single-core CPU saturation by an rclone worker with no corresponding network throughput or file I/O.
Repeated SFTP client disconnects or session resets tied to rclone serve sftp restart events.
New or modified .sqsh or .squashfs files written into buckets, shares, or directories exposed through an :archive: remote.

Detection Strategies

Alert on rclone process exits that emit panic stack traces mentioning squashfs, metadata, or go-diskfs.
Correlate rclone serve sftp restarts with immediately preceding archive access events from SFTP audit logs.
Flag rclone binaries running versions v1.72.0 through v1.74.4 reported by asset inventory.

Monitoring Recommendations

Track per-process CPU time for rclone workers and alert when a single worker exceeds a defined threshold without matching bytes transferred.
Log every write of .sqsh and .squashfs files to storage backends fronted by an rclone archive remote.
Ingest rclone stderr into a centralized log store so panic traces are retained after the process exits.

How to Mitigate CVE-2026-79775

Immediate Actions Required

Upgrade rclone to v1.75.0 or later on every host that runs the binary or serves it through rclone serve sftp.
Inventory storage locations exposed through :archive: remotes and audit them for unexpected SquashFS files.
Restrict write access to archive-backed storage so untrusted users cannot introduce SquashFS images.

Patch Information

The rclone maintainers fixed the parser in rclone v1.75.0. The fix adds validation for the superblock block size, inode metadata offsets, and metadata stream length before those values reach arithmetic, slice, or loop operations. Refer to the GitHub Security Advisory GHSA-6jcg-q3wp-x2f4 for commit references and the patched release notes.

Workarounds

Disable the archive backend by removing :archive: remotes from rclone.conf until upgrade is complete.
Deny access to .sqsh and .squashfs objects in storage buckets or directories fronted by rclone.
Run rclone serve sftp under a supervisor such as systemd with automatic restart to shorten crash-driven outages while patching.

bash

# Verify installed rclone version and confirm remediation
rclone version | head -n 1
# Expected: rclone v1.75.0 or later

# List archive remotes that should be reviewed or removed prior to patching
rclone listremotes --long | grep -i archive