CVE-2026-79778 rclone before v1.75.0 Denial of Service via TUS nil-response panic
A malicious endpoint can trigger a panic in rclone's WebDAV TUS handler, causing a denial of service by terminating unrecovered goroutines.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-79778?
CVE-2026-79778 is a medium-severity vulnerability in rclone, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.
Weakness: CWE-248
Which versions are affected by CVE-2026-79778?
4 open source packages ship an affected version, including github.com/rclone/rclone and rclone.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | All versions | 1.75.0 |
github.com/rclone/rclone Go | All versions | 1.75.0 |
github.com/rclone/rclone Go | All versions | 1.75.0 |
rclone Bitnami | All versions | 1.75.0 |
How do I fix CVE-2026-79778?
Upgrade github.com/rclone/rclone to 1.75.0 or later.
Is CVE-2026-79778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79778 exists.
Sources
Also known as BIT-rclone-2026-79778, DEBIAN-CVE-2026-79778, GHSA-3x6r-wxxg-53vv, GHSA-hqc5-cqqv-7gwf, GO-2026-6183, MINI-6cjx-25g4-645q and 8 more.