Denial of Service Vulnerability in Rclone by Rclone

CVE-2026-88015

What is CVE-2026-88015?

Rclone is a command-line program designed for syncing files and directories across various cloud storage providers. Prior to version 1.75.1, a vulnerability existed in the 'backend/local' mode when using the --links option. This issue allowed symlink targets to be exposed as .rclonelink objects. Specifically, the fs.RangeOption.Decode method could pass an unchecked positive Range start to Object.Open and openTranslatedLink, leading to a deterministic slice-bounds panic. When the object was exposed via HTTP or WebDAV, this resulted in a request-level denial-of-service scenario. Although the Go net/http package typically handles such panics per connection, this vulnerability did not crash the entire server process. It was addressed in Rclone version 1.75.1.

References