CVE-2026-88015
Received Received - Intake

rclone Symlink Target Slice Bounds Panic via HTTP/WebDAV

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88015
EUVD
EUVD-2026-75575

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone to 1.75.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in rclone versions before 1.75.1 involves a panic condition when handling Range requests on symlinks. When the --links flag is used, symlinks are exposed as .rclonelink objects containing the target path. A crafted Range request with an offset larger than the target path length causes a slice bounds panic during string slicing in openTranslatedLink.

Detection Guidance

To detect this vulnerability, check the rclone version in use with 'rclone version'. If it is 1.75.0 or earlier, the system is potentially vulnerable. Monitor HTTP/WebDAV logs for requests with Range headers containing unusually large offset values (e.g., 'Range: bytes=99999999999-').

Commands to check version: rclone version. Look for panic logs in application logs indicating 'slice bounds out of range' errors during Range requests.

Impact Analysis

An attacker can send a single crafted Range header to trigger a denial of service for that specific request. The impact is limited to the affected request as Go's net/http recovers panics per-connection. No authentication or race conditions are required for exploitation.

Compliance Impact

This vulnerability causes a denial of service (DoS) for individual requests due to a panic in the request-handling process, but does not directly impact data confidentiality or integrity. It may affect compliance with availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule) by potentially disrupting service availability for users accessing files via HTTP or WebDAV.

Mitigation Strategies

Upgrade rclone to version 1.75.1 or later immediately. If upgrading is not possible, disable the --links flag or links=true configuration option to prevent symlink exposure via HTTP/WebDAV.

Apply input validation to Range headers to reject excessively large offset values. Monitor and restrict access to HTTP/WebDAV endpoints until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart