CVE-2026-79778: rclone WebDAV TUS Handler DOS Vulnerability

CVE-2026-79778 Overview

CVE-2026-79778 is a denial of service vulnerability in rclone before version v1.75.0. The flaw resides in the WebDAV TUS creation handler, which dereferences a nil HTTP response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic. The panic terminates unrecovered goroutines and halts unrelated work in long-lived rclone processes. The issue is classified under CWE-248: Uncaught Exception.

Critical Impact
Attackers controlling a configured WebDAV endpoint can crash long-lived rclone processes, disrupting file synchronization, backup jobs, and mounted remotes.

Affected Products

rclone versions prior to v1.75.0
Deployments using WebDAV backends with TUS resumable upload support
Long-lived rclone processes such as rclone mount, rclone serve, and daemonized sync jobs

Discovery Timeline

2026-08-25 - CVE-2026-79778 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79778

Vulnerability Analysis

The vulnerability exists in rclone's WebDAV backend handling of TUS (Tus Resumable Upload Protocol) creation requests. When rclone initiates a TUS upload, the client issues a POST request to the WebDAV endpoint to create the upload resource. The response handling logic dereferences the returned *http.Response value before verifying whether the accompanying error indicated a transport failure.

When the remote server abruptly resets the TCP connection, the Go HTTP client returns a non-nil error and a nil response object. Accessing fields on the nil response triggers a runtime panic. Because the panic propagates through a goroutine without a recover() handler, it terminates the goroutine and, in long-lived processes, halts unrelated concurrent work such as other transfers, mount operations, or scheduled syncs.

Root Cause

The root cause is missing error-first validation in the TUS creation handler. Idiomatic Go HTTP code must check the returned error before touching the response pointer, since Go guarantees only one of the two is meaningful. The rclone WebDAV backend inverted this contract, treating the response as always valid.

Attack Vector

Exploitation requires that a user has configured a WebDAV remote pointing to an attacker-controlled or compromised endpoint that supports TUS uploads. The attacker resets the TCP connection during the TUS creation phase to force the Go HTTP client to return a nil response with a transport error. This triggers the nil pointer dereference and panics the rclone process. The attack vector is network-based but requires user interaction to initiate an upload against the malicious endpoint. See the rclone GitHub Security Advisory GHSA-3x6r-wxxg-53vv and the VulnCheck advisory on rclone for additional technical detail.

// See the linked security advisories for technical details.
// No verified exploit code is published for this issue.

Detection Methods for CVE-2026-79778

Indicators of Compromise

Unexpected termination of rclone processes accompanied by Go runtime panic traces referencing the WebDAV backend
Log entries containing runtime error: invalid memory address or nil pointer dereference from rclone goroutines handling TUS creation
Repeated TCP RST packets from a WebDAV endpoint during POST requests to TUS creation URLs

Detection Strategies

Inventory rclone binaries across servers, workstations, and containers and flag versions earlier than v1.75.0
Monitor process supervisors and orchestrators for abnormal exits of rclone mounts, serve daemons, or scheduled sync jobs
Correlate rclone crash events with network telemetry showing connection resets against configured WebDAV endpoints

Monitoring Recommendations

Ship rclone stdout and stderr to a centralized logging pipeline to capture Go panic traces
Alert on rclone process restart counts exceeding baseline thresholds in systemd, Kubernetes, or container platforms
Track outbound TLS connections from rclone to WebDAV hosts and flag domains that were not previously approved

How to Mitigate CVE-2026-79778

Immediate Actions Required

Upgrade rclone to v1.75.0 or later on all systems that use WebDAV remotes
Review rclone.conf files to identify configured WebDAV endpoints and validate that each remote points to a trusted host
Restart long-lived rclone processes such as mounts and serve daemons after upgrading to load the patched binary

Patch Information

The rclone project fixed this issue in release v1.75.0 by validating the transport error before dereferencing the HTTP response in the WebDAV TUS creation handler. Refer to the rclone GitHub Security Advisory GHSA-3x6r-wxxg-53vv for the upstream fix and version guidance.

Workarounds

Restrict rclone WebDAV remotes to endpoints under organizational control until the upgrade is completed
Wrap long-lived rclone invocations with a process supervisor that restarts the service on unexpected exit
Disable or remove WebDAV remotes that use TUS uploads if a patched build cannot be deployed immediately

bash

# Verify the installed rclone version is patched
rclone version

# Upgrade to the fixed release on Linux
curl https://rclone.org/install.sh | sudo bash

# Confirm version is v1.75.0 or later
rclone version | head -n 1