CVE-2026-79775
Received Received - Intake

Denial-of-Service in rclone via SquashFS Parser

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79775
EUVD
EUVD-2026-65533

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone From 1.72.0 (inc) to 1.74.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79775 is a denial-of-service vulnerability in rclone versions 1.72.0 to 1.74.4 affecting the SquashFS parser in the archive backend. The parser fails to validate attacker-controlled superblock and metadata values, allowing crafted SquashFS images to trigger crashes or CPU loops.

Detection Guidance

Detecting this vulnerability requires checking the rclone version in use. Run 'rclone version' to verify if your version is between 1.72.0 and 1.74.4. Additionally, inspect SquashFS images accessed via rclone archive remotes for unusual behavior like crashes or high CPU usage when accessed.

Impact Analysis

This vulnerability can crash rclone processes, including SFTP servers, leading to service disruption. It may also cause sustained high CPU usage, degrading system performance. Exploitation requires an attacker to place a malicious SquashFS image in accessible storage and for a victim to access it.

Compliance Impact

This vulnerability primarily impacts system availability by causing process crashes or CPU exhaustion, which could lead to service disruptions. For GDPR, availability is a key principle, so prolonged outages may raise compliance concerns. HIPAA requires safeguards against unauthorized access or disruptions, which this flaw could exacerbate if exploited to degrade system performance.

Mitigation Strategies

Immediately upgrade rclone to version 1.75.0 or later. If upgrading is not possible, restrict access to archive remotes and SquashFS images from untrusted sources. Monitor rclone processes for crashes or abnormal CPU usage as potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79775. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart