Denial-of-Service Vulnerabilities in rclone Archive Backend's SquashFS Parser

CVE-2026-79775

What is CVE-2026-79775?

Versions of rclone from v1.72.0 to v1.74.4 are affected by multiple denial-of-service vulnerabilities in the SquashFS parser of the archive backend. These vulnerabilities arise from improper validation of attacker-controlled superblock and metadata values, allowing an adversary to craft malicious SquashFS images. When such an image is accessed, it can lead to severe consequences, including an integer division-by-zero panic, out-of-bounds slice panic, or a non-progress CPU loop due to truncated metadata. These issues not only terminate the rclone process but can also crash entire SFTP servers when leveraging the 'rclone serve sftp' functionality, or lead to sustained CPU consumption if left unaddressed. The parsing mechanism operates lazily, meaning attackers must entice victims to engage with the malicious archive to trigger these vulnerabilities.

References