CVE-2026-79778

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-79778

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79778.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-79778

Aliases

Downstream

DEBIAN-CVE-2026-79778

Published

2026-08-25T15:16:08.402Z

Modified

2026-08-27T11:47:42.581769675Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

rclone before v1.75.0 Denial of Service via TUS nil-response panic

Details

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79778.json",
    "cwe_ids": [
        "CWE-248"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/rclone/rclone

Affected ranges

Type

GIT

Repo

https://github.com/rclone/rclone

Events

Introduced

Fixed

9ee9d0a0cafd5e5fe3b271d2280b090ab6e64048

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.75.0"
        },
        {
            "fixed": "v1.75.0"
        }
    ]
}

Affected versions

v0.*

v0.90

v0.91

v0.92

v0.93

v0.94

v0.95

v0.96

v0.97

v0.98

v0.99

v1.*

v1.00

v1.01

v1.03

v1.04

v1.05

v1.06

v1.07

v1.08

v1.09

v1.10

v1.11

v1.12

v1.13

v1.14

v1.15

v1.16

v1.17

v1.18

v1.19

v1.20

v1.21

v1.22

v1.23

v1.24

v1.25

v1.26

v1.27

v1.28

v1.29

v1.29-1-gbb75d80

v1.30

v1.31

v1.32

v1.33

v1.34

v1.35

v1.36

v1.37

v1.38

v1.39

v1.40

v1.41

v1.42

v1.43

v1.44

v1.45

v1.46

v1.46.0

v1.47.0

v1.48.0

v1.49.0

v1.50.0

v1.51.0

v1.52.0

v1.53.0

v1.54.0

v1.55.0

v1.56.0

v1.57.0

v1.58.0

v1.59.0

v1.60.0

v1.61.0

v1.62.0

v1.63.0

v1.64.0

v1.65.0

v1.66.0

v1.67.0

v1.68.0

v1.69.0

v1.70.0

v1.71.0

v1.72.0

v1.73.0

v1.74.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79778.json"