{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "rclone-1.73.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the rclone-1.73.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10313",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10313-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1229 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1229/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27141 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27141/"
      }
    ],
    "title": "rclone-1.73.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-03-09T00:00:00Z",
      "generator": {
        "date": "2026-03-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10313-1",
      "initial_release_date": "2026-03-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-03-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.2-1.1.aarch64",
                "product": {
                  "name": "rclone-1.73.2-1.1.aarch64",
                  "product_id": "rclone-1.73.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-bash-completion-1.73.2-1.1.aarch64",
                "product": {
                  "name": "rclone-bash-completion-1.73.2-1.1.aarch64",
                  "product_id": "rclone-bash-completion-1.73.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-zsh-completion-1.73.2-1.1.aarch64",
                "product": {
                  "name": "rclone-zsh-completion-1.73.2-1.1.aarch64",
                  "product_id": "rclone-zsh-completion-1.73.2-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.2-1.1.ppc64le",
                "product": {
                  "name": "rclone-1.73.2-1.1.ppc64le",
                  "product_id": "rclone-1.73.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-bash-completion-1.73.2-1.1.ppc64le",
                "product": {
                  "name": "rclone-bash-completion-1.73.2-1.1.ppc64le",
                  "product_id": "rclone-bash-completion-1.73.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-zsh-completion-1.73.2-1.1.ppc64le",
                "product": {
                  "name": "rclone-zsh-completion-1.73.2-1.1.ppc64le",
                  "product_id": "rclone-zsh-completion-1.73.2-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.2-1.1.s390x",
                "product": {
                  "name": "rclone-1.73.2-1.1.s390x",
                  "product_id": "rclone-1.73.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-bash-completion-1.73.2-1.1.s390x",
                "product": {
                  "name": "rclone-bash-completion-1.73.2-1.1.s390x",
                  "product_id": "rclone-bash-completion-1.73.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-zsh-completion-1.73.2-1.1.s390x",
                "product": {
                  "name": "rclone-zsh-completion-1.73.2-1.1.s390x",
                  "product_id": "rclone-zsh-completion-1.73.2-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.2-1.1.x86_64",
                "product": {
                  "name": "rclone-1.73.2-1.1.x86_64",
                  "product_id": "rclone-1.73.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-bash-completion-1.73.2-1.1.x86_64",
                "product": {
                  "name": "rclone-bash-completion-1.73.2-1.1.x86_64",
                  "product_id": "rclone-bash-completion-1.73.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-zsh-completion-1.73.2-1.1.x86_64",
                "product": {
                  "name": "rclone-zsh-completion-1.73.2-1.1.x86_64",
                  "product_id": "rclone-zsh-completion-1.73.2-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64"
        },
        "product_reference": "rclone-1.73.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le"
        },
        "product_reference": "rclone-1.73.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x"
        },
        "product_reference": "rclone-1.73.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64"
        },
        "product_reference": "rclone-1.73.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-bash-completion-1.73.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64"
        },
        "product_reference": "rclone-bash-completion-1.73.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-bash-completion-1.73.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le"
        },
        "product_reference": "rclone-bash-completion-1.73.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-bash-completion-1.73.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x"
        },
        "product_reference": "rclone-bash-completion-1.73.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-bash-completion-1.73.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64"
        },
        "product_reference": "rclone-bash-completion-1.73.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-zsh-completion-1.73.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64"
        },
        "product_reference": "rclone-zsh-completion-1.73.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-zsh-completion-1.73.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le"
        },
        "product_reference": "rclone-zsh-completion-1.73.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-zsh-completion-1.73.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x"
        },
        "product_reference": "rclone-zsh-completion-1.73.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-zsh-completion-1.73.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
        },
        "product_reference": "rclone-zsh-completion-1.73.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1229",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1229"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in  v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64",
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le",
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x",
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1229",
          "url": "https://www.suse.com/security/cve/CVE-2026-1229"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-09T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-1229"
    },
    {
      "cve": "CVE-2026-27141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64",
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le",
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x",
          "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x",
          "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x",
          "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27141",
          "url": "https://www.suse.com/security/cve/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259062 for CVE-2026-27141",
          "url": "https://bugzilla.suse.com/1259062"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-bash-completion-1.73.2-1.1.x86_64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.aarch64",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.ppc64le",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.s390x",
            "openSUSE Tumbleweed:rclone-zsh-completion-1.73.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27141"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "traefik-3.6.10-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the traefik-3.6.10-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10385",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10385-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27141 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27141/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-29777 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-29777/"
      }
    ],
    "title": "traefik-3.6.10-2.1 on GA media",
    "tracking": {
      "current_release_date": "2026-03-17T00:00:00Z",
      "generator": {
        "date": "2026-03-17T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10385-1",
      "initial_release_date": "2026-03-17T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-03-17T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.10-2.1.aarch64",
                "product": {
                  "name": "traefik-3.6.10-2.1.aarch64",
                  "product_id": "traefik-3.6.10-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.10-2.1.ppc64le",
                "product": {
                  "name": "traefik-3.6.10-2.1.ppc64le",
                  "product_id": "traefik-3.6.10-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.10-2.1.s390x",
                "product": {
                  "name": "traefik-3.6.10-2.1.s390x",
                  "product_id": "traefik-3.6.10-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.10-2.1.x86_64",
                "product": {
                  "name": "traefik-3.6.10-2.1.x86_64",
                  "product_id": "traefik-3.6.10-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.10-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64"
        },
        "product_reference": "traefik-3.6.10-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.10-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le"
        },
        "product_reference": "traefik-3.6.10-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.10-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x"
        },
        "product_reference": "traefik-3.6.10-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.10-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
        },
        "product_reference": "traefik-3.6.10-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x",
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27141",
          "url": "https://www.suse.com/security/cve/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259062 for CVE-2026-27141",
          "url": "https://bugzilla.suse.com/1259062"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-17T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27141"
    },
    {
      "cve": "CVE-2026-29777",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-29777"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an HTTPRoute resource can inject backtick-delimited rule tokens into Traefik\u0027s router rule language via unsanitized header or query parameter match values. In shared gateway deployments, this can bypass listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled backends. This vulnerability is fixed in 3.6.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x",
          "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-29777",
          "url": "https://www.suse.com/security/cve/CVE-2026-29777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259525 for CVE-2026-29777",
          "url": "https://bugzilla.suse.com/1259525"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.s390x",
            "openSUSE Tumbleweed:traefik-3.6.10-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-03-17T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-29777"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for rclone",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.73.5:\n  * Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * iclouddrive: fix \u0027directory not found\u0027 error when the directory contains accent marks\n  * Start v1.73.5-DEV development\n\n- Update to version 1.73.4:\n  * Version v1.73.4\n  * Update to go 1.25.9 to fix multiple CVEs\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * fix(docs): Fix link to not be language specific\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Start v1.73.4-DEV development\n\n- Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)\n  * Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * docs: added text to the label showing version-introduced info\n  * Start v1.73.3-DEV development\n  * docs: update sponsors\n\n- Update to version 1.73.2:\n  * Version v1.73.2\n  * Update to go 1.25.8 to fix multiple CVEs\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * docs: fix new drive flag typo in changelog\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * docs: note that --use-server-modtime only works on some backends\n  * internxt: fix Entry doesn\u0027t belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * docs: Fix headers hierarchy for mount.md\n  * webdav: escape reserved characters in URL path segments\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * docs: add instructions on how to update Go version\n  * buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229\n  * Start v1.73.2-DEV development\n\n- Update to version 1.73.1:\n  * Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * Start v1.73.1-DEV development\n\n- Update to version 1.73.0:\n  * Version v1.73.0\n  * drive: fix crash when trying to creating shortcut to a Google doc\n  * azureblob,azurefiles: factor the common auth into a library\n  * test: allow backends to return fs.ErrorCantListRoot to skip Root tests\n  * build: add privatebeta Makefile target\n  * docs: add Internxt as a sponsor\n  * internxt: remove use of CVE laden github.com/disintegration/imaging\n  * docs: fix Internxt docs after merge\n  * docs: update making a new backend docs\n  * docs: build overview page from the backend data\n  * docs: add tiering to the documentation - fixes #8873\n  * docs: add data about each backend in YAML format\n  * docs: add bin/manage_backends.py for managing the backend data files\n  * internxt: use rclone\u0027s http.Client to enable more features\n  * internxt: fix lint problems\n  * Add StarHack to contributors\n  * Add lullius to contributors\n  * Add jzunigax2 to contributors\n  * internxt: add Internxt backend - fixes #7610\n  * drive: add --drive-metadata-force-expansive-access flag - Fixes #8980\n  * test_all: allow drime more time to complete\n  * onedrive: fix permissions on onedrive Personal\n  * onedrive: fix require sign in for Onedrive Personal\n  * onedrive: Onedrive Personal no longer supports description\n  * onedrive: fix setting modification time on directories for onedrive Personal\n  * onedrive: fix cancelling multipart upload\n  * docs: fix WinFsp link in mount documentation\n  * cmount: make work under OpenBSD - fixes #1727\n  * vfs: make mount tests run on OpenBSD\n  * docs: improve alignment of icons\n  * protondrive: update to use forks of upstream modules\n  * Add hyusap to contributors\n  * Add Nick Owens to contributors\n  * Add Mikel Olasagasti Uranga to contributors\n  * docs: fix googlephotos custom client_id instructions\n  * cmount: fix OpenBSD mount support.\n  * fs: fix bwlimit: correctly report minutes\n  * fs: fix bwlimit: use %d instead of %q for ints\n  * mega: reverts TLS workaround\n  * docs: fix formatting\n  * docs: add faq entry about re-enabling old TLS ciphers\n  * Add Marc-Philip to contributors\n  * Add yy to contributors\n  * filen: swap to blake3 hashes\n  * docs: fix echo command syntax for password input\n  * docs: fix typos in comments and messages\n  * docs: fix use of removed rem macro\n  * uptobox: remove backend as service is no longer available\n  * rc: add operations/hashsumfile to sum a single file only\n  * docs: update sponsor link\n  * filen: add Filen backend - Fixes #6728\n  * sftp: fix proxy initialisation\n  * fstest: skip Copy mutation test with --sftp-copy-is-hardlink\n  * fstest: Make Copy mutation test work properly\n  * Add Qingwei Li to contributors\n  * Add Nicolas Dessart to contributors\n  * log: fix systemd adding extra newline - fixes #9086\n  * oracleobjectstorage, sftp: eliminate unnecessary heap allocation\n  * sftp,ftp: add http proxy authentication support\n  * Add Drime backend\n  * lib/rest: add opts.MultipartContentType to explicitly set Content-Type of attachements\n  * dircache: allow empty string as root parent id\n  * docs: update sponsors\n  * s3: add provider Bizfly Cloud Simple Storage\n  * docs: update sponsor logos\n  * Add sys6101 to contributors\n  * Add darkdragon-001 to contributors\n  * Add vupn0712 to contributors\n  * docs: add cloudinary to readme\n  * docs: fix headers hierarchy in mount docs\n  * s3: fix Copy ignoring storage class\n  * serve s3: make errors in --s3-auth-key fatal - fixes #9044\n  * Add masrlinu to contributors\n  * pcloud: add support for real-time updates in mount\n  * memory: add --memory-discard flag for speed testing - fixes #9037\n  * Add vyv03354 to contributors\n  * shade: Fix VFS test issues\n  * docs: mention use of ListR feature in ls docs\n  * build: bump actions/download-artifact from 6 to 7\n  * build: bump actions/upload-artifact from 5 to 6\n  * build: bump actions/cache from 4 to 5\n  * docs: reflects the fact that pCloud supports ListR\n  * S3: Linode: updated endpoints to use ISO 3166-1 alpha-2 standard\n  * sync: fix error propagation in tests (#9025)\n  * Changelog updates from Version v1.72.1\n  * s3: add more regions for Selectel\n  * Add jhasse-shade to contributors\n  * Add Shade backend\n  * log: fix backtrace not going to the --log-file #9014\n  * build: fix lint warning after linter upgrade\n  * Add Jonas Tingeborn to contributors\n  * Add Tingsong Xu to contributors\n  * configfile: add piped config support - fixes #9012\n  * fs/log: fix PID not included in JSON log output\n  * build: adjust lint rules to exclude new errors from linter update\n  * proxy: fix error handling in tests spotted by the linter\n  * Add Johannes Rothe to contributors\n  * Add Leo to contributors\n  * Add Vladislav Tropnikov to contributors\n  * Add Cliff Frey to contributors\n  * Add vicerace to contributors\n  * b2: Fix listing root buckets with unrestricted API key\n  * googlecloudstorage: improve endpoint parameter docs\n  * serve webdav: implement download-directory-as-zip\n  * s3: The ability to specify an IAM role for cross-account interaction\n  * azureblob: add metadata and tags support across upload and copy paths\n  * refactor: use strings.Cut to simplify code\n  * docs: note where a provider has an S3 compatible alternative\n  * Add Shade as sponsor\n  * Add Duncan Smart to contributors\n  * Add Diana to contributors\n  * docs: Clarify OAuth scopes for readonly Google Drive access\n  * b2: support authentication with new bucket restricted application keys\n  * docs: update sponsor logos\n  * docs: fix lint error in changelog\n  * Start v1.73.0-DEV development\n\n- Update to version 1.72.1:\n  * Version v1.72.1\n  * s3: add more regions for Selectel\n  * log: fix backtrace not going to the --log-file #9014\n  * build: fix lint warning after linter upgrade\n  * configfile: add piped config support - fixes #9012\n  * fs/log: fix PID not included in JSON log output\n  * build: adjust lint rules to exclude new errors from linter update\n  * proxy: fix error handling in tests spotted by the linter\n  * googlecloudstorage: improve endpoint parameter docs\n  * docs: note where a provider has an S3 compatible alternative\n  * Add Shade as sponsor\n  * docs: Clarify OAuth scopes for readonly Google Drive access\n  * docs: update sponsor logos\n  * docs: fix lint error in changelog\n  * Start v1.72.1-DEV development\n\n- Update to version 1.72.0:\n  * Version v1.72.0\n  * rc: fix formatting in job/batch\n  * test speed: fix formatting of help\n  * docs: update sponsor logos\n  * build: bump actions/checkout from 5 to 6\n  * s3: add multi-part-upload support for If-Match and If-None-Match\n  * rc: config/unlock: rename parameter to `configPassword` accept old as well\n  * rc: correct names of parameters in job/list output\n  * Add Nikolay Kiryanov to contributors\n  * rc: add `executeId` to job statuses - fixes #8972\n  * build: bump golang.org/x/crypto from 0.43.0 to 0.45.0 to fix CVE-2025-58181\n  * s3: fix single file copying behavior with low permission - Fixes #8975\n  * docs: onedrive: note how to backup up any user\u0027s data\n  * Add Dominik Sander to contributors\n  * Add jijamik to contributors\n  * box: allow to configure with config file contents\n  * http: add basic metadata and provide it via serve\n  * ftp: fix transfers from servers that return 250 ok messages\n  * b2: allow individual old versions to be deleted with --b2-versions - fixes #1626\n  * build: fix tls: failed to verify certificate: x509: negative serial number\n  * Add Sean Turner to contributors\n  * s3: add support for --upload-header If-Match and If-None-Match\n  * fix: comment typos\n  * dropbox: fix error moving just created objects - fixes #8881\n  * s3: add --s3-use-data-integrity-protections to fix  BadDigest error in Alibaba, Tencent\n  * rc: make sure fatal errors don\u0027t crash rclone - fixes #8955\n  * pacer: factor call stack searching into its own package\n  * rc: add osVersion, osKernel and osArch to core/version\n  * build: update all dependencies\n  * build(deps): bump golangci/golangci-lint-action from 8 to 9\n  * webdav: fix out of memory with sharepoint-ntlm when uploading large file\n  * testserver: fix owncloud test server startup\n  * Add aliaj1 to contributors\n  * ulozto: Fix downloads returning HTML error page\n  * docs: adjust spectra logic example endpoint name\n  * docs: update version introduced to v1.70 in doi docs\n  * testserver: fix HDFS server after run.bash adjustments\n  * testserver: remind developers about allocating a port\n  * testserver: make run.bash variables less likely to collide with scripts\n  * testserver: fix seafile servers messing up _connect string\n  * testserver: make sure TestWebdavInfiniteScale uses an assigned port\n  * testserver: make sure we don\u0027t overwrite the NAME variable set\n  * Add n4n5 to contributors\n  * Add Alex to contributors\n  * Add Copilot to contributors\n  * docs: update contributing docs regarding backend documentation\n  * rc: add jobs stats\n  * docs: fix alignment of some of the icons in the storage system dropdown\n  * docs: run markdownlint on _index.md\n  * docs: fix markdownlint issues and other styling improvements in backend command docs\n  * docs: fix markdownlint issue md046/code-block-style in backend command docs\n  * docs: fix missing punctuation in backend commands short description\n  * docs: fix markdownlint issues in backend command generated output\n  * build: improve backend docs autogenerated marker line\n  * backend/compress: add zstd compression\n  * sftp: fix zombie SSH processes with --sftp-ssh - Fixes #8929\n  * testserver: fix tests failing due to stopped servers\n  * docs: add new integration tester site link\n  * docs: update the method for running integration tests\n  * bisync: fix failing tests\n  * Add SublimePeace to contributors\n  * b2: fix \"expected a FileSseMode but found: \u0027\u0027\"\n  * docs: s3: clarify multipart uploads memory usage\n  * test_all: fix detection of running servers\n  * accounting: add AccountReadN for use in cluster\n  * fs: add NonDefaultRC for discovering options in use\n  * fs: move tests into correct files\n  * rc: add NewJobFromBytes for reading jobs from non HTTP transactions\n  * rc: add job/batch for sending batches of rc commands to run concurrently\n  * Add Ted Robertson to contributors\n  * Add Joseph Brownlee to contributors\n  * Add fries1234 to contributors\n  * Add Fawzib Rojas to contributors\n  * Add Riaz Arbi to contributors\n  * Add Lukas Krejci to contributors\n  * Add Adam Dinwoodie to contributors\n  * Add dulanting to contributors\n  * docs: add AppArmor restrictions to rclone mount\n  * check: improved reporting of differences in sizes and contents\n  * mega: implement 2FA login\n  * docs: change to light code block style to better match overall theme\n  * docs: fix various markdownlint issues\n  * build: restrict the markdown languages to use for code blocks\n  * docs: fix various markdownlint issues\n  * docs: fix markdownlint issue md013/line-length\n  * docs: change syntax hightlighting for command examples from sh to console\n  * docs: Clarify remote naming convention\n  * b2: Add Server-Side encryption support\n  * Added rclone archive command to create and read archive files\n  * accounting: add io.Seeker/io.ReaderAt support to accounting.Account\n  * operations: add ReadAt method to ReOpen\n  * fstest: add ResetRun to allow the remote to be reset in tests\n  * gcs: fix --gcs-storage-class to work with server side copy for objects\n  * ulozto: implement the about functionality\n  * local: add --skip-specials to ignore special files\n  * swift: Report disk usage in segment containers\n  * refactor: use strings.Builder to improve performance\n  * Archive backend to read archives on cloud storage.\n  * vfs: remove unecessary import in tests to fix import cycles\n  * Add Lakshmi-Surekha to contributors\n  * Add Andrew Gunnerson to contributors\n  * Add divinity76 to contributors\n  * build: enable support for aix/ppc64\n  * rc: fix name of \"queue\" JSON key in docs for vfs/cache\n  * cmount: windows: improve error message on missing winfsp\n  * docs: add the Provider to the options examples in the backend docs\n  * Add Aneesh Agrawal to contributors\n  * Add viocha to contributors\n  * Add reddaisyy to contributors\n  * fs: remove unnecessary Seek call on log file\n  * s3: make it easier to add new S3 providers\n  * build(deps): bump actions/upload-artifact from 4 to 5\n  * build(deps): bump actions/download-artifact from 5 to 6\n  * ftp: fix SOCK proxy support - fixes #8892 (#8918)\n  * webdav: Add Access-Control-Max-Age header for CORS preflight caching - fixes #5078\n  * webdav: use SpaceSepList to parse bearer token command\n  * refactor: use strings.Builder to improve performance\n  * docs: re-arrange sponsors page\n  * docs: add Spectra Logic as a sponsor\n  * Add Oleksandr Redko to contributors\n  * build: enable all govet checks (except fieldalignment and shadow) and fix issues.\n  * march: fix --no-traverse being very slow - fixes #8860\n  * Add vastonus to contributors\n  * s3: add new FileLu S5 endpoints\n  * build: remove obsolete build tag\n  * azurefiles: add ListP interface - #4788\n  * dropbox: add ListP interface - #4788\n  * webdav: add ListP interface - #4788\n  * pcloud: add ListP interface - #4788\n  * box: add ListP interface - #4788\n  * onedrive: add ListP interface - #4788\n  * drive: add ListP interface - #4788\n  * Add hunshcn to contributors\n  * webdav: optimize bearer token fetching with singleflight\n  * Changelog updates from Version v1.71.2\n  * lib/http: cleanup indentation and other whitespace in http serve template\n  * docs: improve formatting of http serve template parameters\n  * build: stop markdown linter leaving behind docker containers\n  * Add Marco Ferretti to contributors\n  * s3: add cubbit as provider\n  * s3: add servercore as a provider\n  * docs: update sponsors\n  * docs: update sponsor images\n  * docs: update privacy policy with a section on user data\n  * Add Dulani Woods to contributors\n  * Add spiffytech to contributors\n  * gcs: add region us-east5 - fixes #8863\n  * jottacloud: refactor service list from map to slice to get predefined order\n  * jottacloud: added support for traditional oauth authentication also for the main service\n  * oauthutil: improved debug logs from token refresh\n  * backend: add S3 provider for Hetzner object storage #8183\n  * jottacloud: improved token refresh handling\n  * s3: provider reordering\n  * index: add missing providers\n  * docs: add missing `\n  * s3: add rabata as a provider\n  * mega: fix 402 payment required errors - fixes #8758\n  * Add Andrew Ruthven to contributors\n  * Add Microscotch to contributors\n  * Add iTrooz to contributors\n  * build: Bump SwiftAIO container to a newer one\n  * build: Retry stopping the test server\n  * build: Increase attempts to connect to test server\n  * swift: If storage_policy isn\u0027t set, use the root containers policy\n  * proton: automated 2FA login with OTP secret key\n  * serve s3: fix log output to remove the EXTRA messages\n  * docs/jottacloud: update description of invalid_grant error according to changes\n  * jottacloud: add support for MediaMarkt Cloud as a whitelabel service\n  * s3: add FileLu S5 provider\n  * docs: fix variants of --user-from-header\n  * vfs: fix chunker integration test\n  * test_all: give TestZoho: extra time as it has been timing out\n  * test_all: give TestCompressDrive: extra time as it has been timing out\n  * rclone config string: reduce quoting with Human rendering for strings #8859\n  * Add juejinyuxitu to contributors\n  * docs/jottacloud: update documentation with new whitelabel services and changed configuration flow\n  * jottacloud: abort attempts to run unsupported rclone authorize command\n  * jottacloud: minor adjustment of texts in config ui\n  * jottacloud: add support for Let\u0027s Go Cloud (from MediaMarkt) as a whitelabel service\n  * jottacloud: fix authentication for whitelabel services from Elkjp subsidiaries\n  * jottacloud: refactor config handling of whitelabel services to use openid provider configuration\n  * jottacloud: remove nil error object from error message\n  * jottacloud: fix legacy authentication\n  * docs: add remote setup page to main docs dropdown\n  * docs: update remote setup page\n  * docs: add link from authorize command docs to remote setup docs\n  * docs: lowercase internet and web browser instead of Internet browser\n  * docs: use the term backend name instead of fs name for authorize command\n  * add `rclone config string` for making connection strings #8859\n  * config: add more human readable configmap.Simple output\n  * serve http: download folders as zip\n  * s3: reorder providers to be in alphabetical order\n  * refactor: use strings.FieldsFuncSeq to reduce memory allocations\n  * accounting: add SetMaxCompletedTransfers method to fix bisync race #8815\n  * accounting: add RemoveDoneTransfers method to fix bisync race #8815\n  * bisync: fix race when CaptureOutput is used concurrently #8815\n  * build: update all dependencies\n  * Makefile: remove deprecated go mod usage\n  * azurefiles: Fix server side copy not waiting for completion -  fixes #8848\n  * Changelog updates from Version v1.71.1\n  * test_all: fix branch name in test report\n  * pacer: fix deadlock with --max-connections\n  * Revert \"azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\"\n  * Add Youfu Zhang to contributors\n  * Add Matt LaPaglia to contributors\n  * smb: optimize smb mount performance by avoiding stat checks during initialization\n  * pikpak: fix unnecessary retries by using URL expire parameter - fixes #8601\n  * serve http: fix: logging url on start\n  * docs: fix typo\n  * b2: fix 1TB+ uploads\n  * march: fix deadlock when using --fast-list on syncs - fixes #8811\n  * build: slices.Contains, added in go1.21\n  * build: use strings.CutPrefix introduced in go1.20\n  * build: use sequence Split introduced in go1.24\n  * build: use \"for i := range n\", added in go1.22\n  * build: modernize benchmark usage\n  * build: in tests use t.Context, added in go1.24\n  * build: replace interface{} by the \u0027any\u0027 type added in go1.18\n  * build: use the built-in min or max functions added in go1.21\n  * Add russcoss to contributors\n  * build: remove x := x made unnecessary by the new semantics of loops in go1.22\n  * lib/pool: fix unreliable TestPoolMaxBufferMemory test\n  * Update S-Pegg1 email\n  * Add Jean-Christophe Cura to contributors\n  * pool: fix flaky unreliability test\n  * copyurl: reworked code, added concurrency and tests\n  * copyurl: Added --url to read urls from csv file - #8127\n  * docs: HDFS: erasure coding limitation #8808\n  * fstest: fix slice bounds out of range error when using -remotes local\n  * local: fix time zones on tests\n  * s3: added SpectraLogic as a provider\n  * local: fix rmdir \"Access is denied\" on windows - fixes #8363\n  * bisync: fix error handling for renamed conflicts\n  * docs: pcloud: update root_folder_id instructions\n  * operations: fix partial name collisions for non --inplace copies\n  * drive: docs: update making your own client ID instructions\n  * swift: add ListP interface - #4788\n  * memory: add ListP interface - #4788\n  * oraceobjectstorage: add ListP interface - #4788\n  * B2: add ListP interface - #4788\n  * azureblob: add ListP interface - #4788\n  * googlecloudstorage: add ListP interface - Fixes #8763\n  * build: bump actions/github-script from 7 to 8\n  * build: bump actions/setup-go from 5 to 6\n  * bisync: fix chunker integration tests\n  * bisync: fix koofr integration tests\n  * internetarchive: fix server side copy files with spaces\n  * lib/rest: add URLPathEscapeAll to URL escape as many chars as possible\n  * Add alternate email for dougal to contributors\n  * test speed: add command to test a specified remotes speed\n  * docs: add link to MEGA S4 from MEGA page\n  * Add Robin Rolf to contributors\n  * Add anon-pradip to contributors\n  * s3: Add Intercolo provider\n  * gendocs: refactor and add logging of skipped command docs\n  * gendocs: ignore missing rclone_mount.md, rclone_nfsmount.md, rclone_serve_nfs.md on windows\n  * bin: add bisync.md generator\n  * fstest: refactor to decouple package from implementation\n  * gendocs: ignore missing rclone_mount.md on macOS\n  * bisync: ignore expected \"nothing to transfer\" differences on tests\n  * bisync: fix TestBisyncConcurrent ignoring -case\n  * bisync: make number of parallel tests configurable\n  * docs: clarify subcommand description in rclone usage\n  * docs: fix description of regex syntax of name transform\n  * docs: add some more details about supported regex syntax\n  * makefile: fix lib/transform docs not getting updated\n  * lib/pool: fix flaky test which was causing timeouts\n  * Add dougal to contributors\n  * vfs: fix SIGHUP killing serve instead of flushing directory caches\n  * bisync: use unique stats groups on tests\n  * fstest: stop errors in test cleanup changing the global stats\n  * Add Motte to contributors\n  * Add Claudius Ellsel to contributors\n  * build: add local markdown linting to make check\n  * lsf: add support for unix and unixnano time formats\n  * docs: remove broken links from rc to commands\n  * hashsum: changed output format when listing algorithms\n  * docs: add example of how to add date as suffix\n  * box: fix about after change in API return - fixes #8776\n  * Add skbeh to contributors\n  * Add Tilman Vogel to contributors\n  * docs: fix incorrectly escaped windows path separators\n  * build: restore error handling in gendocs\n  * combine: propagate SlowHash feature\n  * docs/oracleobjectstorage: add introduction before external links and remove broken link\n  * docs: fix markdown lint issues in backend docs\n  * docs: fix markdown lint issues in command docs\n  * docs: update markdown code block json indent size 2\n  * mount: do not log successful unmount as an error - fixes #8766\n  * Start v1.72.0-DEV development\n\n- Update to version 1.71.2:\n  * Version v1.71.2\n  * docs: update sponsors\n  * docs: update sponsor images\n  * docs: update privacy policy with a section on user data\n  * gcs: add region us-east5 - fixes #8863\n  * index: add missing providers\n  * docs: add missing `\n  * mega: fix 402 payment required errors - fixes #8758\n  * docs: fix variants of --user-from-header\n  * docs: add remote setup page to main docs dropdown\n  * docs: update remote setup page\n  * docs: add link from authorize command docs to remote setup docs\n  * docs: lowercase internet and web browser instead of Internet browser\n  * docs: use the term backend name instead of fs name for authorize command\n  * bisync: fix race when CaptureOutput is used concurrently #8815\n  * azurefiles: Fix server side copy not waiting for completion -  fixes #8848\n  * pikpak: fix unnecessary retries by using URL expire parameter - fixes #8601\n  * serve http: fix: logging url on start\n  * docs: fix typo\n  * b2: fix 1TB+ uploads\n  * Start v1.71.2-DEV development\n\n- Update to version 1.71.1:\n  * Version v1.71.1\n  * pacer: fix deadlock with --max-connections\n  * Revert \"azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\"\n  * march: fix deadlock when using --fast-list on syncs - fixes #8811\n  * docs: HDFS: erasure coding limitation #8808\n  * local: fix rmdir \"Access is denied\" on windows - fixes #8363\n  * bisync: fix error handling for renamed conflicts\n  * docs: pcloud: update root_folder_id instructions\n  * operations: fix partial name collisions for non --inplace copies\n  * drive: docs: update making your own client ID instructions\n  * internetarchive: fix server side copy files with spaces\n  * lib/rest: add URLPathEscapeAll to URL escape as many chars as possible\n  * docs: add link to MEGA S4 from MEGA page\n  * docs: clarify subcommand description in rclone usage\n  * docs: fix description of regex syntax of name transform\n  * docs: add some more details about supported regex syntax\n  * makefile: fix lib/transform docs not getting updated\n  * vfs: fix SIGHUP killing serve instead of flushing directory caches\n  * docs: remove broken links from rc to commands\n  * docs: add example of how to add date as suffix\n  * box: fix about after change in API return - fixes #8776\n  * docs: fix incorrectly escaped windows path separators\n  * build: restore error handling in gendocs\n  * combine: propagate SlowHash feature\n  * docs/oracleobjectstorage: add introduction before external links and remove broken link\n  * docs: fix markdown lint issues in backend docs\n  * docs: fix markdown lint issues in command docs\n  * docs: update markdown code block json indent size 2\n  * mount: do not log successful unmount as an error - fixes #8766\n  * Start v1.71.1-DEV development\n\n- Update to version 1.71.0:\n  * Version v1.71.0\n  * fs: tls: add --client-pass support for encrypted --client-key files\n  * ftp: make TLS config default to global TLS config - Fixes #6671\n  * fshttp: return *Transport rather than http.RoundTripper from NewTransport\n  * bisync: release from beta\n  * bisync: fix markdown formatting issues flagged by linter in docs\n  * bisync: fix --no-slow-hash settings on path2\n  * Add cui to contributors\n  * docs: add code of conduct\n  * lib/mmap: convert to using unsafe.Slice to avoid deprecated reflect.SliceHeader\n  * build: bump golangci/golangci-lint-action from 6 to 8\n  * build: update golangci-lint configuration\n  * build: ignore revive lint issue var-naming: avoid meaningless package names\n  * build: fix lint issue: should omit type error from declaration\n  * Revert \"build: downgrade linter to use go1.24 until it is fixed for go1.25\"\n  * build: migrate golangci-lint configuration to v2 format\n  * s3: add --s3-use-arn-region flag - fixes #8686\n  * Add Binbin Qian to contributors\n  * Add Lucas Bremgartner to contributors\n  * docs: add tips about outdated certificates\n  * FAQ: specify the availability of SSL_CERT_* env vars\n  * pikpak: add file name integrity check during upload\n  * bisync: skip TestBisyncConcurrent on non-local\n  * internetarchive: fix server side copy files with \u0026\n  * Revert \"s3: set useAlreadyExists to false for Alibaba OSS\"\n  * Add huangnauh to contributors\n  * smb: improve multithreaded upload performance using multiple connections\n  * bisync: fix data races on tests\n  * bisync: remove unused parameters\n  * bisync: deglobalize to fix concurrent runs via rc - fixes #8675\n  * mount: fix identification of symlinks in directory listings\n  * s3: fix Content-Type: aws-chunked causing upload errors with --metadata\n  * config: fix problem reading pasted tokens over 4095 bytes\n  * config: fix test failure on local machine with a config file\n  * log: add log rotation to --log-file - fixes #2259\n  * accounting: Fix stats (speed=0 and eta=nil) when starting jobs via rc\n  * docs: update overview table for oracle object storage\n  * Add praveen-solanki-oracle to contributors\n  * oracleobjectstorage: add read only metadata support - Fixes #8705\n  * doc: sync doesn\u0027t symlinks in dest without --link - Fixes #8749\n  * s3: sort providers in docs\n  * s3: add docs for Exaba Object Storage\n  * azureblob: fix double accounting for multipart uploads - fixes #8718\n  * pool: fix deadlock with --max-buffer-memory\n  * azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\n  * build: downgrade linter to use go1.24 until it is fixed for go1.25\n  * build: update all dependencies\n  * build: update to go1.25 and make go1.24 the minimum required version\n  * Add Timothy Jacobs to contributors\n  * bisync: fix time.Local data race on tests - fixes #8272\n  * googlecloudstorage: fix rateLimitExceeded error on bisync tests\n  * accounting: populate transfer snapshot with \"what\" value\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump actions/download-artifact from 4 to 5\n  * googlecloudstorage: enable bisync integration tests\n  * fstest: fix parsing of commas in -remotes\n  * azurefiles: fix hash getting erased when modtime is set\n  * bisync: disable --sftp-copy-is-hardlink on sftp tests\n  * local: fix --copy-links on Windows when listing Junction points\n  * operations: fix too many connections open when using --max-memory\n  * pool: fix deadlock with --max-memory and multipart transfers\n  * pool: unify memory between multipart and asyncreader to use one pool\n  * docs: update links to rcloneui\n  * docs: add MEGA S4 as a gold sponsor\n  * about: fix potential overflow of about in various backends\n  * box: fix about: cannot unmarshal number 1.0e+18 into Go struct field\n  * oauthutil: fix nil pointer crash when started with expired token\n  * rc: listremotes should send an empty array instead of nil\n  * config: add error if RCLONE_CONFIG_PASS was supplied but didn\u0027t decrypt config\n  * rc: add config/unlock to unlock the config file\n  * ftp: allow insecure TLS ciphers - fixes #8701\n  * s3: set useAlreadyExists to false for Alibaba OSS\n  * docs: update sponsors page\n  * fs: allow global variables to be overriden or set on backend creation\n  * fs: allow setting of --http_proxy from command line\n  * tests: cloudinary: remove test ignore after merging fix from #8707\n  * Add Antonin Goude to contributors\n  * Add Yu Xin to contributors\n  * Add houance to contributors\n  * Add Florent Vennetier to contributors\n  * Add n4n5 to contributors\n  * Add Albin Parou to contributors\n  * Add liubingrun to contributors\n  * sync: fix testLoggerVsLsf when backend only reads modtime\n  * sync: fix testLoggerVsLsf checking wrong fs\n  * docs: fix make opengraph tags absolute as not all sites understand relative\n  * docs: update contributing guide regarding markdown documentation\n  * build: add markdown linting to workflow\n  * build: add markdownlint configuration\n  * docs: minor format cleanup install.md\n  * docs: fix markdownlint issue md049/emphasis-style\n  * docs: fix markdownlint issue md036/no-emphasis-as-heading\n  * docs: fix markdownlint issue md033/no-inline-html\n  * docs: fix markdownlint issue md025/single-title\n  * docs: fix markdownlint issue md041/first-line-heading\n  * docs: fix markdownlint issue md001/heading-increment\n  * docs: fix markdownlint issue md003/heading-style\n  * docs: fix markdownlint issue md034/no-bare-urls\n  * docs: fix markdownlint issue md010/no-hard-tabs\n  * docs: fix markdownlint issue md013/line-length\n  * docs: fix markdownlint issue md038/no-space-in-code\n  * docs: fix markdownlint issue md040/fenced-code-language\n  * docs: fix markdownlint issue md046/code-block-style\n  * docs: fix markdownlint issue md037/no-space-in-emphasis\n  * docs: fix markdownlint issue md059/descriptive-link-text\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style\n  * docs: fix markdownlint issue md012/no-multiple-blanks\n  * docs: fix markdownlint issue md058/blanks-around-tables\n  * docs: fix markdownlint issue md022/blanks-around-headings\n  * docs: fix markdownlint issue md031/blanks-around-fences\n  * docs: fix markdownlint issue md032/blanks-around-lists\n  * docs: fix markdownlint issue md009/no-trailing-spaces\n  * docs: fix markdownlint issue md014/commands-show-output\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style (bin/update-authors.py)\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style (authors.md)\n  * docs: add opengraph tags for website social media previews\n  * mount: note that bucket based remotes can use directory markers\n  * pikpak: add docs for methods to clarify name collision handling and restrictions\n  * pikpak: enhance Copy method to handle name collisions and improve error management\n  * pikpak: enhance Move for better handling of error and name collision\n  * accounting: fix incorrect stats with --transfers=1 - fixes #8670\n  * rc: fix `operations/check` ignoring `oneWay` parameter\n  * s3: add OVHcloud Object Storage provider\n  * docs: rc: fix description of how to read local config\n  * build: limit check for edits of autogenerated files to only commits in a pull request\n  * build: extend check for edits of autogenerated files to all commits in a pull request\n  * smb: refresh Kerberos credentials when ccache file changes\n  * s3: fix multipart upload and server side copy when using bucket policy SSE-C\n  * backend/s3: Fix memory leak by cloning strings #8683\n  * purge: exit with a fatal error if filters are set on `rclone purge`\n  * docs: Add Backblaze as a Platinum sponsor\n  * Add Sam Pegg to contributors\n  * googlephotos: added warning for Google Photos compatability-fixes #8672\n  * test: remove flakey TestChunkerChunk50bYandex: test\n  * docs: Consolidate entries for Josh Soref in contributors\n  * docs: remove dead link to example of writing a plugin\n  * filescom: document that hashes need to be enabled - fixes #8674\n  * Add Sudipto Baral to contributors\n  * docs: fix incorrect json syntax in sample output\n  * docs: ignore author email piyushgarg80\n  * docs: fix header level for --dump option section\n  * docs: use stringArray as parameter type\n  * docs: use consistent markdown heading syntax\n  * imagekit: remove server side Copy method as it was downloading and uploading\n  * imagekit: don\u0027t low level retry uploads\n  * imagekit: return correct error when attempting to upload zero length files\n  * smb: add --smb-kerberos-ccache option to set kerberos ccache per smb backend\n  * test: fix smb kerberos integration tests\n  * Changelog updates from Version v1.70.3\n  * config: make parsing of duration options consistent\n  * docs: cleanup usage\n  * docs: break long lines\n  * docs: add option value type to header where missing\n  * docs: mention that identifiers in option values are case insensitive\n  * docs: rewrite dump option examples\n  * docs: use markdown inline code format for dump option headers that are real examples\n  * docs: change spelling from server side to server-side\n  * docs: cleanup header casing\n  * docs: rename OSX to macOS\n  * docs: fix list and code block issue\n  * docs: consistent markdown list format\n  * docs: split section with general description of options with that documenting actual main options\n  * docs: improve description of option types\n  * docs: use space instead of equal sign to separate option and value in headers\n  * docs: use comma to separate short and long option format in headers\n  * docs: remove use of uncommon parameter types\n  * docs: remove use of parameter type FILE\n  * docs: remove use of parameter type DIR\n  * docs: remove use of parameter type CONFIG_FILE\n  * docs: change use of parameter type N and NUMBER to int consistent with flags and cli help\n  * docs: change use of parameter type TIME to Duration consistent with flags and cli help\n  * docs: change use of parameter type BANDWIDTH_SPEC to BwTimetable consistent with flags and cli help\n  * docs: change use of parameter type SIZE to SizeSuffix consistent with flags and cli help\n  * docs: cleanup markdown header format\n  * docs: explain separated list parameters\n  * azureblob: fix server side copy error \"requires exactly one scope\"\n  * test: remove and ignore failing integration tests\n  * docs: explain the json log format in more detail\n  * check: fix difference report (was reporting error counts)\n  * serve sftp: add support for more hashes (crc32, sha256, blake3, xxh3, xxh128)\n  * serve sftp: extract function refactoring for handling hashsum commands\n  * sftp: add support for more hashes (crc32, sha256, blake3, xxh3, xxh128)\n  * local: configurable supported hashes\n  * hash: add support for BLAKE3, XXH3, XXH128\n  * vfs: make integration TestDirEntryModTimeInvalidation test more reliable\n  * smb: skip non integration tests when doing integration tests\n  * seafile: fix integration test errors by adding dot to encoding\n  * linkbox: fix upload error \"user upload file not exist\"\n  * build: remove integration tests which are too slow\n  * march: fix deadlock when using --no-traverse - fixes #8656\n  * pikpak: improve error handling for missing links and unrecoverable 500s\n  * pikpak: rewrite upload to bypass AWS S3 manager - fixes #8629\n  * test: fix TestSMBKerberos password expiring errors\n  * Add Vikas Bhansali to contributors\n  * Add Ross Smith II to contributors\n  * azureblob,azurefiles: add support for client assertion based authentication\n  * webdav: fix setting modtime to that of local object instead of remote\n  * build: set default shell to bash in build.yml\n  * docs: fix filescom/filelu link mixup\n  * Add Davide Bizzarri to contributors\n  * fix: b2 versionAt read metadata\n  * test: make TestWebdavInfiniteScale startup more reliable\n  * test_all: add _connect_delay for slow starting servers\n  * docs: update link for filescom\n  * test_all: make TestWebdav InfiniteScale integration tests run\n  * test_all: make SMB with Kerberos integration tests run properly\n  * test_all: allow an env parameter to set environment variables\n  * Changelog updates from Version v1.70.2\n  * Add Ali Zein Yousuf to contributors\n  * Add $@M@RTH_ to contributors\n  * docs: update client ID instructions to current Azure AD portal - fixes #8027\n  * s3: add Zata provider\n  * pacer: fix nil pointer deref in RetryError - fixes #8077\n  * docs: Remove Warp as a sponsor\n  * docs: add files.com as a Gold sponsor\n  * docs: add links to SecureBuild docker image\n  * Add curlwget to contributors\n  * convmv: fix moving to unicode-equivalent name - fixes #8634\n  * transform: add truncate_keep_extension and truncate_bytes\n  * convmv: make --dry-run logs less noisy\n  * sync: avoid copying dir metadata to itself\n  * docs: fix some function names in comments\n  * combine: fix directory not found errors with ListP interface - Fixes #8627\n  * local: fix --skip-links on Windows when skipping Junction points\n  * Add Marvin Rsch to contributors\n  * build: bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 to fix GHSA-vrw8-fxc6-2r93\n  * copy,copyto,move,moveto: implement logger flags to store result of sync\n  * log: fix deadlock when using systemd logging - fixes #8621\n  * docs: googlephotos: detail how to make your own client_id - fixes #8622\n  * Add necaran to contributors\n  * mega: fix tls handshake failure - fixes #8565\n  * Changelog updates from Version v1.70.1\n  * Add jinjingroad to contributors\n  * docs: DOI grammar error\n  * docs: lib/transform: cleanup formatting\n  * lib/transform: avoid empty charmap entry\n  * chore: fix function name\n  * convmv: fix spurious \"error running command echo\" on Windows\n  * docs: client-credentials is not support by all backends\n  * Start v1.71.0-DEV development\n\n- Update to version 1.70.3:\n  * Version v1.70.3\n  * azureblob: fix server side copy error \"requires exactly one scope\"\n  * docs: explain the json log format in more detail\n  * check: fix difference report (was reporting error counts)\n  * linkbox: fix upload error \"user upload file not exist\"\n  * march: fix deadlock when using --no-traverse - fixes #8656\n  * pikpak: improve error handling for missing links and unrecoverable 500s\n  * webdav: fix setting modtime to that of local object instead of remote\n  * fix: b2 versionAt read metadata\n  * Start v1.70.3-DEV development\n  * docs: fix filescom/filelu link mixup\n  * docs: update link for filescom\n\n- Update to version 1.70.2:\n  * Version v1.70.2\n  * docs: update client ID instructions to current Azure AD portal - fixes #8027\n  * mega: fix tls handshake failure - fixes #8565\n  * pacer: fix nil pointer deref in RetryError - fixes #8077\n  * convmv: fix moving to unicode-equivalent name - fixes #8634\n  * convmv: make --dry-run logs less noisy\n  * sync: avoid copying dir metadata to itself\n  * combine: fix directory not found errors with ListP interface - Fixes #8627\n  * local: fix --skip-links on Windows when skipping Junction points\n  * build: bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 to fix GHSA-vrw8-fxc6-2r93\n  * log: fix deadlock when using systemd logging - fixes #8621\n  * docs: googlephotos: detail how to make your own client_id - fixes #8622\n  * pikpak: fix uploads fail with \"aws-chunked encoding is not supported\" error\n  * Start v1.70.2-DEV development\n  * docs: Remove Warp as a sponsor\n  * docs: add files.com as a Gold sponsor\n  * docs: add links to SecureBuild docker image\n\n- Update to version 1.70.1:\n  * Version v1.70.1\n  * docs: DOI grammar error\n  * docs: lib/transform: cleanup formatting\n  * lib/transform: avoid empty charmap entry\n  * chore: fix function name\n  * convmv: fix spurious \"error running command echo\" on Windows\n  * docs: client-credentials is not support by all backends\n  * Start v1.70.1-DEV development\n\n- Update to version 1.70.0:\n  * Version v1.70.0\n  * ftp: add --ftp-http-proxy to connect via HTTP CONNECT proxy\n  * pcloud: fix \"Access denied. You do not have permissions to perform this operation\" on large uploads\n  * operations: fix TransformFile when can\u0027t server-side copy/move\n  * fstest: fix -verbose flag after logging revamp\n  * googlecloudstorage: fix directory marker after // changes in #5858\n  * s3: fix directory marker after // changes in #5858\n  * azureblob: fix directory marker after // changes in #5858\n  * tests: ignore some more habitually failing tests\n  * googlephotos: fix typo in error message - Fixes #8600\n  * s3: MEGA S4 support\n  * Add Ser-Bul to contributors\n  * chunker: fix double-transform\n  * docs: mailru: added note about permissions level choice for the  apps password\n  * tests: ignore habitually failing tests and backends\n  * docs: link to asciinema rather than including the js\n  * docs: target=\"_blank\" must have rel=\"noopener\"\n  * sync: fix testLoggerVsLsf when dst is local\n  * docs: fix FileLu docs\n  * build: update all dependencies\n  * onedrive: fix crash if no metadata was updated\n  * Add kingston125 to contributors\n  * Add Flora Thiebaut to contributors\n  * Add FileLu cloud storage backend\n  * doi: add new doi backend\n  * build: fix check_autogenerated_edits.py flagging up files that didn\u0027t exist\n  * docs: rc: add more info on how to discover _config and _filter parameters #8584\n  * s3: add Exaba provider\n  * convmv: add convmv command\n  * lib/transform: add transform library and --name-transform flag\n  * march: split src and dst\n  * Add ahxxm to contributors\n  * Add Nathanael Demacon to contributors\n  * b2: use file id from listing when not presented in headers - fixes #8113\n  * fs: fix goroutine leak and improve stats accounting process\n  * march: fix syncing with a duplicate file and directory\n  * Add PrathameshLakawade to contributors\n  * Add Oleksiy Stashok to contributors\n  * docs: fix page_facing_up typo next to Lyve Cloud in README.md\n  * backend/s3: require custom endpoint for Lyve Cloud v2 support\n  * backend: skip hash calculation when the hashType is None - fixes #8518\n  * azureblob: fix multipart server side copies of 0 sized files\n  * Add Jeremy Daer to contributors\n  * Add wbulot to contributors\n  * s3: add Pure Storage FlashBlade provider support (#8575)\n  * backend/gofile: update to use new direct upload endpoint\n  * log: add --windows-event-log-level to support Windows Event Log\n  * fs: Remove github.com/sirupsen/logrus and replace with log/slog\n  * Add fhuber to contributors\n  * cmd serve s3: fix ListObjectsV2 response\n  * Changelog updates from Version v1.69.3\n  * onedrive: re-add --onedrive-upload-cutoff flag\n  * onedrive: fix \"The upload session was not found\" errors\n  * Add Germn Casares to contributors\n  * Add Jeff Geerling to contributors\n  * googlephotos: update read only and read write scopes to meet Google\u0027s requirements.\n  * build: update github.com/ebitengine/purego to v0.8.3 to fix mac_amd64 build\n  * docs: add hint about config touch and config file not found\n  * docs: add FAQ for dismissing \u0027rclone.conf not found\u0027\n  * docs: document how to keep an out of tree backend\n  * Add Clment Wehrung to contributors\n  * iclouddrive: fix panic and files potentially downloaded twice\n  * docs: move --max-connections documentation to the correct place\n  * Add Ben Boeckel to contributors\n  * Add Tho Neyugn to contributors\n  * docs: fix typo in s3/storj docs\n  * serve s3: remove redundant handler initialization\n  * Changelog updates from Version 1.69.2\n  * sftp: add --sftp-http-proxy to connect via HTTP CONNECT proxy\n  * Add Jugal Kishore to contributors\n  * docs: correct SSL docs anchor link from #ssl-tls to #tls-ssl\n  * drive: metadata: fix error when setting copy-requires-writer-permission on a folder\n  * docs: Update contributors\n  * build: bump golang.org/x/net from 0.36.0 to 0.38.0\n  * Update README.md\n  * docs: fix typos via codespell\n  * webdav: add an ownCloud Infinite Scale vendor that enables tus chunked upload support\n  * onedrive: fix metadata ordering in permissions\n  * Add Ben Alex to contributors\n  * Add simwai to contributors\n  * iclouddrive: fix so created files are writable\n  * cmd/authorize: show required arguments in help text\n  * cloudinary: var naming convention - #8416\n  * cloudinary: automatically add/remove known media files extensions #8416\n  * Add Markus Gerstel to contributors\n  * Add Enduriel to contributors\n  * Add huanghaojun to contributors\n  * Add simonmcnair to contributors\n  * Add Samantha Bowen to contributors\n  * s3: documentation regression - fixes #8438\n  * hash: add SHA512 support for file hashes\n  * vfs: fix inefficient directory caching when directory reads are slow\n  * docs: update fuse version in docker docs\n  * fs/config: Read configuration passwords from stdin even when terminated with EOF - fixes #8480\n  * cmd/gitannex: Reject unknown layout modes in INITREMOTE\n  * cmd/gitannex: Add configparse.go and refactor\n  * cmd/gitannex: Permit remotes with options\n  * serve ftp: add serve rc interface\n  * serve sftp: add serve rc interface\n  * serve restic: add serve rc interface\n  * serve s3: add serve rc interface\n  * serve dlna: add serve rc interface\n  * serve webdav: add serve rc interface - fixes #4505\n  * serve http: add serve rc interface\n  * serve nfs: add serve rc interface\n  * serve: Add rc control for serve commands #4505\n  * configstruct: add SetAny to parse config from the rc\n  * rc: In options/info make FieldName contain a \".\" if it should be nested\n  * serve restic: convert options to new style\n  * serve s3: convert options to new style\n  * serve http: convert options to new style\n  * serve webdav: convert options to new style\n  * auth proxy: convert options to new style\n  * auth proxy: add VFS options parameter for use for default VFS\n  * serve: make the servers self registering\n  * lib/http: fix race between Serve() and Shutdown()\n  * lib/http: add Addr() method to return the first configured server address\n  * Add Danny Garside to contributors\n  * docs: fix minor typo in box docs\n  * sync: implement --list-cutoff to allow on disk sorting for reduced memory use\n  * march: Implement callback based syncing\n  * list: add ListDirSortedFn for callback oriented directory listing\n  * list: Implement Sorter to sort directory entries\n  * cache: mark ListP as not supported yet\n  * hasher: implement ListP interface\n  * compress: implement ListP interface\n  * chunker: mark ListP as not supported yet\n  * union: mark ListP as not supported yet\n  * crypt: implement ListP interface\n  * combine: implement ListP interface\n  * s3: Implement paged listing interface ListP\n  * list: add WithListP helper to implement List for ListP backends\n  * walk: move NewListRHelper into list.Helper to avoid circular dependency\n  * fs: define ListP interface for paged listing #4788\n  * accounting: Add listed stat for number of directory entries listed\n  * walk: factor Listing helpers into their own file and add tests\n  * serve nfs: make metadata files have special file handles\n  * serve nfs: change the format of --nfs-cache-type symlink file handles\n  * vfs: add --vfs-metadata-extension to expose metadata sidecar files\n  * docs: Add rcloneui.com as Silver Sponsor\n  * Add Klaas Freitag to contributors\n  * Add eccoisle to contributors\n  * Add Fernando Fernndez to contributors\n  * Add alingse to contributors\n  * Add Jrn Friedrich Dreyer to contributors\n  * docs: replace option --auto-filename-header with --header-filename\n  * build: update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to fix CVE-2025-30204\n  * docs/googlephotos: fix typos\n  * build: bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2\n  * operations: fix call fmt.Errorf with wrong err\n  * webdav: retry propfind on 425 status\n  * Add --max-connections to control maximum backend concurrency\n  * rc: fix debug/* commands not being available over unix sockets\n  * cmd/gitannex: Prevent tests from hanging when assertion fails\n  * cmd/gitannex: Add explicit timeout for mock stdout reads in tests\n  * http: correct root if definitely pointing to a file - fixes #8428\n  * pool: add --max-buffer-memory to limit total buffer memory usage\n  * filter: Add `--hash-filter` to deterministically select a subset of files\n  * build: update golang.org/x/net to 0.36.0. to fix CVE-2025-22869\n  * rc: add add short parameter to core/stats to not return transferring and checking\n  * fs: fix corruption of SizeSuffix with \"B\" suffix in config (eg --min-size)\n  * filters: show --min-size and --max-size in --dump filters\n  * build: check docs for edits of autogenerated sections\n  * Add jack to contributors\n  * docs: fix incorrect mentions of vfs-cache-min-free-size\n  * fs/object: fix memory object out of bounds Seek\n  * serve nfs: fix unlikely crash\n  * docs: update minimum OS requirements for go1.24\n  * cmd/gitannex: Tweak parsing of \"rcloneremotename\" config\n  * cmd/gitannex: Drop var rebindings now that we have go1.23\n  * docs: add note for using rclone cat for slicing out a byte range from a file\n  * rcserver: improve content-type check\n  * build: modernize Go usage\n  * build: update all dependencies and fix deprecations\n  * build: update golang.org/x/crypto to v0.35.0 to fix CVE-2025-22869\n  * build: make go1.23 the minimum go version\n  * cmd/gitannex: Add to integration tests\n  * cmd/gitannex: Simplify verbose failures in tests\n  * cmd/gitannex: Port unit tests to fstest\n  * vfs: fix integration test failures\n  * azureblob: fix errors not being retried when doing single part copy\n  * azureblob: handle retry error codes more carefully\n  * touch: make touch obey --transfers\n  * Add luzpaz to contributors\n  * Add Dave Vasilevsky to contributors\n  * docs: fix various typos Found via\n  * dropbox: Retry link without expiry\n  * Dropbox: Support Dropbox Paper\n  * chore: update contributor email\n  * docs: correct stable release workflow\n  * Add Lorenz Brun to contributors\n  * Add Michael Kebe to contributors\n  * vfs: fix directory cache serving stale data\n  * build: fix docker plugin build - fixes #8394\n  * docs: improved sftp limitations\n  * Changelog updates from Version v1.69.1\n  * docs: add FileLu as sponsors and tidy sponsor logos\n  * accounting: fix percentDiff calculation -- fixes #8345\n  * vfs: fix the cache failing to upload symlinks when --links was specified\n  * Add jbagwell-akamai to contributors\n  * Add ll3006 to contributors\n  * doc: add note on concurrency of rclone purge\n  * s3: add latest Linode Object Storage endpoints\n  * cmd: fix crash if rclone is invoked without any arguments - Fixes #8378\n  * build: disable docker builds on PRs \u0026 add missing dockerfile changes\n  * sync: copy dir modtimes even when copyEmptySrcDirs is false - fixes #8317\n  * sync: add tests to check dir modtimes are kept when syncing\n  * fix golangci-lint errors\n  * bisync: fix false positive on integration tests\n  * s3: split the GCS quirks into -s3-use-x-id and -s3-sign-accept-encoding #8373\n  * Add Joel K Biju to contributors\n  * stats: fix the speed not getting updated after a pause in the processing\n  * opendrive: added --opendrive-access flag to handle permissions\n  * bisync: fix listings missing concurrent modifications - fixes #8359\n  * Added parallel docker builds and caching for go build in the container\n  * smb: improve connection pooling efficiency\n  * lib/oauthutil: fix redirect URL mismatch errors - fixes #8351\n  * b2: fix \"fatal error: concurrent map writes\" - fixes #8355\n  * Add Alexander Minbaev to contributors\n  * Add Zachary Vorhies to contributors\n  * Add Jess to contributors\n  * s3: add IBM IAM signer - fixes #7617\n  * serve nfs: update docs to note Windows is not supported - fixes #8352\n  * cmd/config(update remote): introduce --no-output option\n  * s3: add DigitalOcean regions SFO2, LON1, TOR1, BLR1\n  * sync: fix cpu spinning when empty directory finding with leading slashes\n  * s3: fix handling of objects with // in #5858\n  * azureblob: fix handling of objects with // in #5858\n  * fstest: add integration tests objects with // on bucket based backends #5858\n  * fs/list: tweak directory listing assertions after allowing // names\n  * lib/bucket: fix tidying of // in object keys #5858\n  * lib/bucket: add IsAllSlashes function\n  * azureblob: remove uncommitted blocks on InvalidBlobOrBlock error\n  * azureblob: implement multipart server side copy\n  * azureblob: speed up server side copies for small files #8249\n  * azureblob: cleanup uncommitted blocks on upload errors\n  * azureblob: factor readMetaData into readMetaDataAlways returning blob properties\n  * Add b-wimmer to contributors\n  * azurefiles: add --azurefiles-use-az and --azurefiles-disable-instance-discovery\n  * onedrive: mark German (de) region as deprecated\n  * Add Trevor Starick to contributors\n  * Add hiddenmarten to contributors\n  * Add Corentin Barreau to contributors\n  * Add Bruno Fernandes to contributors\n  * Add Moises Lima to contributors\n  * Add izouxv to contributors\n  * Add Robin Schneider to contributors\n  * Add Tim White to contributors\n  * Add Christoph Berger to contributors\n  * azureblob: add support for `x-ms-tags` header\n  * rc: disable the metrics server when running `rclone rc`\n  * internetarchive: add --internetarchive-metadata=\"key=value\" for setting item metadata\n  * lib/batcher: Deprecate unused option: batch_commit_timeout\n  * s3: Added new storage class to magalu provider\n  * http servers: add --user-from-header to use for authentication\n  * b2: add SkipDestructive handling to backend commands - fixes #8194\n  * vfs: close the change notify channel on Shutdown\n  * Docker image: Add label org.opencontainers.image.source for release notes in Renovate dependency updates\n  * docs: add OneDrive Impersonate instructions - fixes #5610\n  * docs: explain the stringArray flag parameter descriptor\n  * iclouddrive: add notes on ADP and Missing PCS cookies - fixes #8310\n  * docs: fix typos found by codespell in docs and code comments\n  * fs: fix confusing \"didn\u0027t find section in config file\" error\n  * vfs: fix race detected by race detector\n  * Add Jonathan Giannuzzi to contributors\n  * Add Spencer McCullough to contributors\n  * Add Matt Ickstadt to contributors\n  * smb: add support for kerberos authentication\n  * drive: added `backend moveid` command\n  * docs: fix reference to serves3 setting disable_multipart_uploads which was renamed\n  * docs: fix link to Rclone Serve S3\n  * serve s3: fix list objects encoding-type\n  * build: update gopkg.in/yaml.v2 to v3\n  * build: update all dependencies\n  * bisync: fix go vet problems with go1.24\n  * build: update to go1.24rc1 and make go1.22 the minimum required version\n  * version: add --deps flag to show dependencies and other build info\n  * doc: make man page well formed for whatis - fixes #7430\n  * Start v1.70.0-DEV development\n\n- Install completion files in the right place.\n\n- Update to version 1.69.3:\n  * build: update github.com/ebitengine/purego to work around bug in go1.24.3\n  * build: reapply update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to fix CVE-2025-30204\n\n- Update to version 1.69.2:\n  - Bug fixes\n    - accounting: Fix percentDiff calculation -- (Anagh Kumar\n      Baranwal)\n    - build\n      - Update github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 to\n        fix CVE-2025-30204 (dependabot[bot])\n      - Update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to\n        fix CVE-2025-30204 (dependabot[bot])\n      - Update golang.org/x/crypto to v0.35.0 to fix CVE-2025-22869\n        (Nick Craig-Wood)\n      - Update golang.org/x/net from 0.36.0 to 0.38.0 to fix\n        CVE-2025-22870 (dependabot[bot])\n      - Update golang.org/x/net to 0.36.0. to fix CVE-2025-22869\n        (dependabot[bot])\n      - Stop building with go \u003c go1.23 as security updates forbade\n        it (Nick Craig-Wood)\n      - Fix docker plugin build (Anagh Kumar Baranwal)\n    - cmd: Fix crash if rclone is invoked without any arguments\n      (Janne Hellsten)\n    - config: Read configuration passwords from stdin even when\n      terminated with EOF (Samantha Bowen)\n    - doc fixes (Andrew Kreimer, Danny Garside, eccoisle, Ed\n      Craig-Wood, emyarod, jack, Jugal Kishore, Markus Gerstel,\n      Michael Kebe, Nick Craig-Wood, simonmcnair, simwai, Zachary\n      Vorhies)\n    - fs: Fix corruption of SizeSuffix with \"B\" suffix in config\n      (eg --min-size) (Nick Craig-Wood)\n    - lib/http: Fix race between Serve() and Shutdown() (Nick\n      Craig-Wood)\n    - object: Fix memory object out of bounds Seek (Nick\n      Craig-Wood)\n    - operations: Fix call fmt.Errorf with wrong err (alingse)\n    - rc\n      - Disable the metrics server when running rclone rc\n        (hiddenmarten)\n      - Fix debug/* commands not being available over unix sockets\n        (Nick Craig-Wood)\n    - serve nfs: Fix unlikely crash (Nick Craig-Wood)\n    - stats: Fix the speed not getting updated after a pause in the\n      processing (Anagh Kumar Baranwal)\n    - sync\n      - Fix cpu spinning when empty directory finding with leading\n        slashes (Nick Craig-Wood)\n      - Copy dir modtimes even when copyEmptySrcDirs is false\n        (ll3006)\n  - vfs\n    - Fix directory cache serving stale data (Lorenz Brun)\n    - Fix inefficient directory caching when directory reads are\n      slow (huanghaojun)\n    - Fix integration test failures (Nick Craig-Wood)\n  - Drive\n    - Metadata: fix error when setting\n      copy-requires-writer-permission on a folder (Nick Craig-Wood)\n  - Dropbox\n    - Retry link without expiry (Dave Vasilevsky)\n  - HTTP\n    - Correct root if definitely pointing to a file (nielash)\n  - Iclouddrive\n    - Fix so created files are writable (Ben Alex)\n  - Onedrive\n    - Fix metadata ordering in permissions (Nick Craig-Wood)\n\n- Update to version 1.69.1:\n  * Version v1.69.1\n  * build: disable docker builds on PRs \u0026 add missing dockerfile changes\n  * Added parallel docker builds and caching for go build in the container\n  * docs: add FileLu as sponsors and tidy sponsor logos\n  * vfs: fix the cache failing to upload symlinks when --links was specified\n  * doc: add note on concurrency of rclone purge\n  * s3: add latest Linode Object Storage endpoints\n  * fix golangci-lint errors\n  * bisync: fix listings missing concurrent modifications - fixes #8359\n  * lib/oauthutil: fix redirect URL mismatch errors - fixes #8351\n  * b2: fix \"fatal error: concurrent map writes\" - fixes #8355\n  * serve nfs: update docs to note Windows is not supported - fixes #8352\n  * s3: add DigitalOcean regions SFO2, LON1, TOR1, BLR1\n  * onedrive: mark German (de) region as deprecated\n  * s3: Added new storage class to magalu provider\n  * vfs: close the change notify channel on Shutdown\n  * docs: add OneDrive Impersonate instructions - fixes #5610\n  * docs: explain the stringArray flag parameter descriptor\n  * iclouddrive: add notes on ADP and Missing PCS cookies - fixes #8310\n  * docs: fix typos found by codespell in docs and code comments\n  * fs: fix confusing \"didn\u0027t find section in config file\" error\n  * vfs: fix race detected by race detector\n  * docs: fix reference to serves3 setting disable_multipart_uploads which was renamed\n  * docs: fix link to Rclone Serve S3\n  * serve s3: fix list objects encoding-type\n  * doc: make man page well formed for whatis - fixes #7430\n  * Start v1.69.1-DEV development\n\n- Update to version 1.69.0:\n  https://rclone.org/changelog/#v1-69-0-2025-01-12\n\n  Rclone is using golang.org/x/net but was not affected to\n  CVE-2024-45337 and CVE-2024-45338.\n\n  * Version v1.69.0\n  * test_all: disable docker plugin tests\n  * docs: fix typo\n  * accounting: fix race stopping/starting the stats counter\n  * docs: add github.com/icholy/gomajor to RELEASE for updating major versions\n  * ftp: fix ls commands returning empty on \"Microsoft FTP Service\" servers\n  * s3: add docs on data integrity\n  * webdav: make --webdav-auth-redirect to fix 401 unauthorized on redirect\n  * rest: make auth preserving redirects an option\n  * box: fix panic when decoding corrupted PEM from JWT file\n  * size: make output compatible with -P\n  * vfs: add remote name to vfs cache log messages - fixes #7952\n  * dropbox: fix return status when full to be fatal error\n  * rc: add relative to vfs/queue-set-expiry\n  * vfs: fix open files disappearing from directory listings\n  * docker serve: parse all remaining mount and VFS options\n  * smb: fix panic if stat fails\n  * googlephotos: fix nil pointer crash on upload - fixes #8233\n  * iclouddrive: tweak docs\n  * serve dlna: sort the directory entries by directories first then alphabetically by name\n  * serve nfs: fix missing inode numbers which was messing up ls -laR\n  * serve nfs: implement --nfs-cache-type symlink\n  * azureblob,oracleobjectstorage,s3: quit multipart uploads if the context is cancelled\n  * http: fix incorrect URLs with initial slash\n  * build: update `github.com/shirou/gopsutil` to v4\n  * Replace Windows-specific NewLazyDLL with NewLazySystemDLL\n  * lib/oauthutil: don\u0027t require token to exist for client credentials flow\n  * fs/operations: make log messages consistent for mkdir/rmdir at INFO level\n  * Add Francesco Frassinelli to contributors\n  * smb: Add support for Kerberos authentication.\n  * docs: smb: link to CloudSoda/go-smb2 fork\n  * cloudinary: add cloudinary backend - fixes #7989\n  * operations: fix eventual consistency in TestParseSumFile test\n  * Add TAKEI Yuya to contributors\n  * docs: Remove Backblaze as a Platinum sponsor\n  * docs: add RcloneView as silver sponsor\n  * serve docker: fix incorrect GID assignment\n  * serve s3: fix Last-Modified timestamp\n  * Add ToM to contributors\n  * Add Henry Lee to contributors\n  * Add Louis Laureys to contributors\n  * docs: filtering: mention feeding --files-from from standard input\n  * docs: filtering: fix --include-from copypaste error\n  * s3: rename glacier storage class to flexible retrieval\n  * b2: add daysFromStartingToCancelingUnfinishedLargeFiles to backend lifecycle command\n  * build: update golang.org/x/net to v0.33.0 to fix CVE-2024-45338\n  * azurefiles: fix missing x-ms-file-request-intent header\n  * Add Thomas ten Cate to contributors\n  * docs: Document --url and --unix-socket on the rc page\n  * docs: link to the outstanding vfs symlinks issue\n  * Add Yxxx to contributors\n  * Add hayden.pan to contributors\n  * docs: update pcloud doc to avoid puzzling token error when use remote rclone authorize\n  * pikpak: add option to use original file links - fixes #8246\n  * rc/job: use mutex for adding listeners thread safety\n  * docs: mention in serve tls options when value is path to file - fixes #8232\n  * build: update all dependencies\n  * accounting: fix debug printing when debug wasn\u0027t set\n  * Add Filipe Azevedo to contributors\n  * fs: make --links flag global and add new --local-links and --vfs-links flag\n  * vfs: add docs for -l/--links flag\n  * nfsmount,serve nfs: introduce symlink support #2975\n  * mount2: introduce symlink support #2975\n  * mount: introduce symlink support #2975\n  * cmount: introduce symlink support #2975\n  * vfstest: make VFS test suite support symlinks\n  * vfs: add symlink support to VFS\n  * vfs: add ELOOP error\n  * vfs: Add link permissions\n  * vfs: Add VFS --links command line switch\n  * vfs: add vfs.WriteFile to match os.WriteFile\n  * fs: Move link suffix to fs\n  * cmount: fix problems noticed by linter\n  * mount2: Fix missing . and .. entries\n  * sftp: fix nil check when using auth proxy\n  * Add Martin Hassack to contributors\n  * serve sftp: resolve CVE-2024-45337\n  * googlecloudstorage: typo fix in docs\n  * onedrive: add support for OAuth client credential flow - fixes #6197\n  * lib/oauthutil: add support for OAuth client credential flow\n  * lib/oauthutil: return error messages from the oauth process better\n  * bin/test_backend_sizes.py fix compile flags and s3 reporting\n  * test makefiles: add --flat flag for making directories with many entries\n  * Add divinity76 to contributors\n  * Add Ilias Ozgur Can Leonard to contributors\n  * Add remygrandin to contributors\n  * Add Michael R. Davis to contributors\n  * cmd/mountlib: better snap mount error message\n  * vfs: with --vfs-used-is-size value is calculated and then thrown away - fixes #8220\n  * serve sftp: fix loading of authorized keys file with comment on last line - fixes #8227\n  * oracleobjectstorage: make specifying compartmentid optional\n  * plcoud: fix failing large file uploads - fixes #8147\n  * docs: add docker volume plugin troubleshooting steps\n  * docs: fix missing `state` parameter in `/auth` link in instructions\n  * build: fix build failure on ubuntu\n  * docs: upgrade fontawesome to v6\n  * s3: fix multitenant multipart uploads with CEPH\n  * Add David Seifert to contributors\n  * Add vintagefuture to contributors\n  * use better docs\n  * googlecloudstorage: update docs on service account access tokens\n  * test_all: POSIX head/tail invocations\n  * icloud: Added note about app specific password not working\n  * s3: fix download of compressed files from Cloudflare R2 - fixes #8137\n  * s3: fix testing tiers which don\u0027t exist except on AWS\n  * Changelog updates from Version v1.68.2\n  * local: fix permission and ownership on symlinks with --links and --metadata\n  * Revert \"Merge commit from fork\"\n  * Add Dimitrios Slamaris to contributors\n  * Merge commit from fork\n  * onedrive: fix integration tests after precision change\n  * operations: fix TestRemoveExisting on crypt backends by shortening the file name\n  * bisync: fix output capture restoring the wrong output for logrus\n  * serve sftp: update github.com/pkg/sftp to v1.13.7 and fix deadlock in tests\n  * build: fix comments after golangci-lint upgrade\n  * build: update all dependencies\n  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1\n  * pikpak: fix fatal crash on startup with token that can\u0027t be refreshed\n  * yandex: fix server side copying over existing object\n  * sugarsync: fix server side copying over existing object\n  * putio: fix server side copying over existing object\n  * onedrive: fix server side copying over existing object\n  * dropbox: fix server side copying over existing object\n  * operations: add RemoveExisting to safely remove an existing file\n  * gofile: fix server side copying over existing object\n  * test_all: try to fix mailru rate limits in integration tests\n  * Add shenpengfeng to contributors\n  * Add Dimitar Ivanov to contributors\n  * docs: fix function name in comment\n  * sftp: allow inline ssh public certificate for sftp\n  * serve s3: fix excess locking which was making serve s3 single threaded\n  * lib/oauthutil: allow the browser opening function to be overridden\n  * Add Moises Lima to contributors\n  * lib/http: disable automatic authentication skipping for unix sockets\n  * onedrive: fix Retry-After handling to look at 503 errors also\n  * s3: Storj provider: fix server-side copy of files bigger than 5GB\n  * s3: add Selectel as a provider\n  * fs: fix Don\u0027t know how to set key \"chunkSize\" on upload errors in tests\n  * drive: implement rclone backend rescue to rescue orphaned files\n  * Add tgfisher to contributors\n  * Add Diego Monti to contributors\n  * Add Randy Bush to contributors\n  * Add Alexandre Hamez to contributors\n  * Add Simon Bos to contributors\n  * docs: mention that inline comments are not supported in a filter-file\n  * s3: add Wasabi eu-south-1 region\n  * docs: fix forward refs in step 9 of using your own client id\n  * docs: fix Scaleway Glacier website URL\n  * dlna: fix loggingResponseWriter disregarding log level\n  * build: remove required property on boolean inputs\n  * build: use inputs context in github workflow\n  * s3: fix crash when using --s3-download-url after migration to SDKv2\n  * docs: update overview to show pcloud can set modtime\n  * Add Andr Tran to contributors\n  * Add Matthias Gatto to contributors\n  * Add lostb1t to contributors\n  * Add Noam Ross to contributors\n  * Add Benjamin Legrand to contributors\n  * s3: add Outscale provider\n  * Add ICloud Drive backend\n  * drive: add support for markdown format\n  * accounting: fix global error acounting\n  * onedrive: fix time precision for OneDrive personal\n  * Add RcloneView as a sponsor\n  * Add Leandro Piccilli to contributors\n  * cache: skip bisync tests\n  * bisync: allow blank hashes on tests\n  * box: fix server-side copying a file over existing dst - fixes #3511\n  * sync: add tests for copying/moving a file over itself\n  * fs/cache: fix parent not getting pinned when remote is a file\n  * gcs: add access token auth with --gcs-access-token\n  * accounting: write the current bwlimit to the log on SIGUSR2\n  * accounting: fix wrong message on SIGUSR2 to enable/disable bwlimit\n  * gphotos: implment --gphotos-proxy to allow download of full resolution media\n  * googlephotos: remove noisy debugging statements\n  * docs: add note to CONTRIBUTING that the overview needs editing in 2 places\n  * test_all: add ignoretests parameter for skipping certain tests\n  * build: replace \"golang.org/x/exp/slices\" with \"slices\" now go1.21 is required\n  * Changelog updates from Version v1.68.1\n  * Makefile: Fail when doc recipes create dir named \u0027$HOME\u0027\n  * Makefile: Prevent `doc` recipe from creating dir named \u0027$HOME\u0027\n  * pikpak: fix cid/gcid calculations for fs.OverrideRemote\n  * bisync: change exit code from 2 to 7 for critically aborted run\n  * cmd: change exit code from 1 to 2 for syntax and usage errors\n  * local: fix --copy-links on macOS when cloning\n  * azureblob: add --azureblob-use-az to force the use of the Azure CLI for auth\n  * azureblob: add --azureblob-disable-instance-discovery\n  * s3: add initial --s3-directory-bucket to support AWS Directory Buckets\n  * Add Lawrence Murray to contributors\n  * backend/protondrive: improve performance of Proton Drive backend\n  * ftp: implement --ftp-no-check-upload to allow upload to write only dirs\n  * docs: document that fusermount3 may be needed when mounting/unmounting\n  * Add rishi.sridhar to contributors\n  * Add quiescens to contributors\n  * docs/zoho: update options\n  * zoho: make upload cutoff configurable\n  * zoho: add support for private spaces\n  * zoho: try to handle rate limits a bit better\n  * zoho: print clear error message when missing oauth scope\n  * zoho: switch to large file upload API for larger files, fix missing URL encoding of filenames for the upload API\n  * zoho: use download server to accelerate downloads\n  * opendrive: add about support to backend\n  * pikpak: fix login issue where token retrieval fails\n  * webdav: nextcloud: implement backoff and retry for 423 LOCKED errors\n  * s3: fix rclone ignoring static credentials when env_auth=true\n  * fs: fix setting stringArray config values from environment variables\n  * rc: fix default value of --metrics-addr\n  * fs: fix --dump filters not always appearing\n  * docs: correct notes on docker manual build\n  * Add ttionya to contributors\n  * build: fix docker release build - fixes #8062\n  * docs: add section for improving performance for s3\n  * onedrive: fix spurious \"Couldn\u0027t decode error response: EOF\" DEBUG\n  * Add Divyam to contributors\n  * serve docker: add missing vfs-read-chunk-streams option in docker volume driver\n  * Start v1.69.0-DEV development\n\n- Update to version 1.68.2:\n  * Version v1.68.2\n  * s3: fix multitenant multipart uploads with CEPH\n  * local: fix permission and ownership on symlinks with --links and --metadata\n    CVE-2024-52522 boo#1233422\n  * bisync: fix output capture restoring the wrong output for logrus\n  * build: fix comments after golangci-lint upgrade\n  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1\n  * pikpak: fix fatal crash on startup with token that can\u0027t be refreshed\n  * serve s3: fix excess locking which was making serve s3 single threaded\n  * onedrive: fix Retry-After handling to look at 503 errors also\n  * s3: Storj provider: fix server-side copy of files bigger than 5GB\n  * docs: mention that inline comments are not supported in a filter-file\n  * docs: fix forward refs in step 9 of using your own client id\n  * docs: fix Scaleway Glacier website URL\n  * dlna: fix loggingResponseWriter disregarding log level\n  * s3: fix crash when using --s3-download-url after migration to SDKv2\n  * docs: update overview to show pcloud can set modtime\n  * Add RcloneView as a sponsor\n  * accounting: fix wrong message on SIGUSR2 to enable/disable bwlimit\n  * pikpak: fix cid/gcid calculations for fs.OverrideRemote\n  * local: fix --copy-links on macOS when cloning\n  * Start v1.68.2-DEV development\n\n- CVE-2024-51744: updated jwt to v4.5.1 (bsc#1232964).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-213",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20620-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1232964",
        "url": "https://bugzilla.suse.com/1232964"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1233422",
        "url": "https://bugzilla.suse.com/1233422"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45337 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45337/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45338 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-51744 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-51744/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-52522 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-52522/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22869 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22869/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22870 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-30204 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-30204/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58181 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58181/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-68121 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-68121/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-1229 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-1229/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-27141 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-27141/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41176 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41176/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41179 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41179/"
      }
    ],
    "title": "Security update for rclone",
    "tracking": {
      "current_release_date": "2026-04-23T16:22:47Z",
      "generator": {
        "date": "2026-04-23T16:22:47Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20620-1",
      "initial_release_date": "2026-04-23T16:22:47Z",
      "revision_history": [
        {
          "date": "2026-04-23T16:22:47Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.5-bp160.1.1.aarch64",
                "product": {
                  "name": "rclone-1.73.5-bp160.1.1.aarch64",
                  "product_id": "rclone-1.73.5-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-bash-completion-1.73.5-bp160.1.1.noarch",
                "product": {
                  "name": "rclone-bash-completion-1.73.5-bp160.1.1.noarch",
                  "product_id": "rclone-bash-completion-1.73.5-bp160.1.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "rclone-zsh-completion-1.73.5-bp160.1.1.noarch",
                "product": {
                  "name": "rclone-zsh-completion-1.73.5-bp160.1.1.noarch",
                  "product_id": "rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.5-bp160.1.1.ppc64le",
                "product": {
                  "name": "rclone-1.73.5-bp160.1.1.ppc64le",
                  "product_id": "rclone-1.73.5-bp160.1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rclone-1.73.5-bp160.1.1.x86_64",
                "product": {
                  "name": "rclone-1.73.5-bp160.1.1.x86_64",
                  "product_id": "rclone-1.73.5-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.5-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64"
        },
        "product_reference": "rclone-1.73.5-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.5-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le"
        },
        "product_reference": "rclone-1.73.5-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-1.73.5-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64"
        },
        "product_reference": "rclone-1.73.5-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-bash-completion-1.73.5-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch"
        },
        "product_reference": "rclone-bash-completion-1.73.5-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rclone-zsh-completion-1.73.5-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        },
        "product_reference": "rclone-zsh-completion-1.73.5-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45337",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45337"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45337",
          "url": "https://www.suse.com/security/cve/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234482 for CVE-2024-45337",
          "url": "https://bugzilla.suse.com/1234482"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-45337"
    },
    {
      "cve": "CVE-2024-45338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45338",
          "url": "https://www.suse.com/security/cve/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234794 for CVE-2024-45338",
          "url": "https://bugzilla.suse.com/1234794"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45338"
    },
    {
      "cve": "CVE-2024-51744",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-51744"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-51744",
          "url": "https://www.suse.com/security/cve/CVE-2024-51744"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1232936 for CVE-2024-51744",
          "url": "https://bugzilla.suse.com/1232936"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-51744"
    },
    {
      "cve": "CVE-2024-52522",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-52522"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-52522",
          "url": "https://www.suse.com/security/cve/CVE-2024-52522"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1233422 for CVE-2024-52522",
          "url": "https://bugzilla.suse.com/1233422"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-52522"
    },
    {
      "cve": "CVE-2025-22869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22869",
          "url": "https://www.suse.com/security/cve/CVE-2025-22869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1239322 for CVE-2025-22869",
          "url": "https://bugzilla.suse.com/1239322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-22869"
    },
    {
      "cve": "CVE-2025-22870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22870",
          "url": "https://www.suse.com/security/cve/CVE-2025-22870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238572 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1238611 for CVE-2025-22870",
          "url": "https://bugzilla.suse.com/1238611"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22870"
    },
    {
      "cve": "CVE-2025-30204",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-30204"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function\u0027s argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-30204",
          "url": "https://www.suse.com/security/cve/CVE-2025-30204"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1240441 for CVE-2025-30204",
          "url": "https://bugzilla.suse.com/1240441"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1240442 for CVE-2025-30204",
          "url": "https://bugzilla.suse.com/1240442"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-30204"
    },
    {
      "cve": "CVE-2025-58181",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58181"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58181",
          "url": "https://www.suse.com/security/cve/CVE-2025-58181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1253784 for CVE-2025-58181",
          "url": "https://bugzilla.suse.com/1253784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58181"
    },
    {
      "cve": "CVE-2025-68121",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-68121"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-68121",
          "url": "https://www.suse.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256818 for CVE-2025-68121",
          "url": "https://bugzilla.suse.com/1256818"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-68121"
    },
    {
      "cve": "CVE-2026-1229",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-1229"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.\nECDH and ECDSA signing relying on this curve are not affected.\n\nThe bug was fixed in  v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-1229",
          "url": "https://www.suse.com/security/cve/CVE-2026-1229"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-1229"
    },
    {
      "cve": "CVE-2026-27141",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-27141"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-27141",
          "url": "https://www.suse.com/security/cve/CVE-2026-27141"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259062 for CVE-2026-27141",
          "url": "https://bugzilla.suse.com/1259062"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-27141"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-41176",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41176"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41176",
          "url": "https://www.suse.com/security/cve/CVE-2026-41176"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262438 for CVE-2026-41176",
          "url": "https://bugzilla.suse.com/1262438"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41176"
    },
    {
      "cve": "CVE-2026-41179",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41179"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
          "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41179",
          "url": "https://www.suse.com/security/cve/CVE-2026-41179"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262439 for CVE-2026-41179",
          "url": "https://bugzilla.suse.com/1262439"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:rclone-1.73.5-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:rclone-bash-completion-1.73.5-bp160.1.1.noarch",
            "openSUSE Leap 16.0:rclone-zsh-completion-1.73.5-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-23T16:22:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41179"
    }
  ]
}