CVE-2026-71310 in Rclone
Summary
by MITRE • 08/05/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in rclone affects versions prior to 1.75.0 and stems from improper handling of HTTP CONNECT responses within the shared proxy helper component located in lib/proxy/http.go. This flaw represents a classic buffer overflow condition that occurs when the http.ReadResponse function processes proxy responses using an unrestricted buffered reader, creating an opportunity for memory exhaustion attacks through oversized HTTP headers.
The technical implementation of this vulnerability involves the HTTP CONNECT method commonly used in proxy configurations to establish tunneling connections for protocols like FTP and SFTP. When rclone establishes proxy connections for these protocols, it relies on the vulnerable helper function that reads proxy responses without adequate bounds checking on header sizes. An attacker positioned within the network path or controlling a compromised proxy server can exploit this by sending HTTP CONNECT responses containing headers that exceed normal size limits, causing the buffered reader to consume excessive memory resources.
The operational impact of this vulnerability extends beyond simple resource exhaustion, particularly in SFTP connections where the malicious proxy parser is invoked before SSH server authentication occurs. This timing allows an attacker to potentially manipulate the connection flow without the target host key validation providing any protection against malicious proxy behavior. The vulnerability affects multiple cloud storage providers since rclone's proxy functionality works across different backend services and protocols that utilize HTTP tunneling mechanisms.
This issue corresponds to CWE-129, which addresses improper validation of buffer sizes, and aligns with ATT&CK technique T1071.004 for application layer protocol: DNS, where the exploitation involves manipulating network traffic to achieve memory exhaustion. The vulnerability represents a critical security gap in rclone's proxy handling implementation that could lead to denial of service conditions and potentially enable more sophisticated attacks if combined with other exploit vectors.
Mitigation strategies include upgrading to rclone version 1.75.0 or later where the fix has been implemented, which likely introduces proper bounds checking on header sizes during HTTP response parsing. Organizations should also implement network monitoring to detect unusual proxy behavior and consider restricting proxy usage in high-security environments where direct connections are feasible. Additionally, security teams should verify that all proxy configurations properly validate and limit header sizes to prevent similar issues in other components of their infrastructure.
The fix implemented in version 1.75.0 demonstrates proper input validation practices by establishing reasonable limits on buffer sizes during HTTP response parsing, preventing the memory exhaustion scenario that occurred with oversized headers. This represents a fundamental security improvement that aligns with industry best practices for preventing resource exhaustion attacks and maintaining system stability under adversarial conditions.