Vulnerability-Lookup

CVE-2026-88015 (GCVE-0-2026-88015)

Vulnerability from cvelistv5 – Published: 2026-09-10 15:50 – Updated: 2026-09-10 16:01

Title

rclone local: crafted Range request against a translated symlink panics (DoS)

Summary

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 16:01 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-248 - Uncaught Exception

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/rclone/rclone/security/advisor…	x_refsource_CONFIRM
https://github.com/rclone/rclone/commit/28bf49d66…	x_refsource_MISC
https://github.com/rclone/rclone/releases/tag/v1.75.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rclone	rclone	Affected: < 1.75.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-88015",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T16:01:29.337669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T16:01:48.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rclone",
          "vendor": "rclone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.75.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-10T15:50:41.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw"
        },
        {
          "name": "https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9"
        },
        {
          "name": "https://github.com/rclone/rclone/releases/tag/v1.75.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rclone/rclone/releases/tag/v1.75.1"
        }
      ],
      "source": {
        "advisory": "GHSA-p6m2-r3w9-mpxw",
        "discovery": "UNKNOWN"
      },
      "title": "rclone local: crafted Range request against a translated symlink panics (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-88015",
    "datePublished": "2026-09-10T15:50:41.414Z",
    "dateReserved": "2026-09-09T19:19:27.407Z",
    "dateUpdated": "2026-09-10T16:01:48.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-88015",
      "date": "2026-09-14",
      "epss": "0.00354",
      "percentile": "0.28753"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-88015\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-10T16:18:08.490\",\"lastModified\":\"2026-09-10T19:54:25.810\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"rclone\",\"product\":\"rclone\",\"versions\":[{\"version\":\"\u003c 1.75.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-10T16:01:29.337669Z\",\"id\":\"CVE-2026-88015\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"},{\"lang\":\"en\",\"value\":\"CWE-248\"}]}],\"references\":[{\"url\":\"https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rclone/rclone/releases/tag/v1.75.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-12T04:00:56+00:00",
      "cve": "CVE-2026-88015",
      "id": "CVE-2026-88015",
      "initial_release_date": "2026-09-10T15:50:41.414000+00:00",
      "product_status:known_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/rclone/rclone: rclone: Denial of Service via crafted Range request against translated symlink",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88015.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:26:17Z",
      "cve": "CVE-2026-88015",
      "id": "CVE-2026-88015",
      "initial_release_date": "2026-09-11T16:26:17Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-88015",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-88015.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-88015\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-10T16:01:29.337669Z\"}}}], \"references\": [{\"url\": \"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-10T16:01:42.811Z\"}}], \"cna\": {\"title\": \"rclone local: crafted Range request against a translated symlink panics (DoS)\", \"source\": {\"advisory\": \"GHSA-p6m2-r3w9-mpxw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"rclone\", \"product\": \"rclone\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.75.1\"}]}], \"references\": [{\"url\": \"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\", \"name\": \"https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9\", \"name\": \"https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/rclone/rclone/releases/tag/v1.75.1\", \"name\": \"https://github.com/rclone/rclone/releases/tag/v1.75.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190: Integer Overflow or Wraparound\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248: Uncaught Exception\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-10T15:50:41.414Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-88015\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-10T16:01:48.110Z\", \"dateReserved\": \"2026-09-09T19:19:27.407Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-10T15:50:41.414Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-88015

Vulnerability from fkie_nvd - Published: 2026-09-10 16:18 - Updated: 2026-09-10 19:54

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9
	security-advisories@github.com	https://github.com/rclone/rclone/releases/tag/v1.75.1
	security-advisories@github.com	https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rclone",
          "vendor": "rclone",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.75.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1."
    }
  ],
  "id": "CVE-2026-88015",
  "lastModified": "2026-09-10T19:54:25.810",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-88015",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-10T16:01:29.337669Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-10T16:18:08.490",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-P6M2-R3W9-MPXW

Vulnerability from github – Published: 2026-09-10 22:49 – Updated: 2026-09-10 22:49

Summary

rclone local: crafted Range request against a translated symlink panics (DoS)

Details

Summary

When backend/local is used with --links/-l (or the links=true config option), each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open() decodes an incoming fs.RangeOption via Decode(o.Size()), then for a translated-symlink object passes the decoded offset straight into openTranslatedLink, which indexes the target string directly: linkdst[offset:].

RangeOption.Decode's Start >= 0 branch (an ordinary Range: bytes=X- request) sets offset = o.Start with no upper bound, unlike its suffix-range branch (Start < 0, e.g. bytes=-N), which already clamps a too-large value to 0 - the fix for a prior, related crash (issue #6310: "bytes=-90407" against a 5-byte object panicked with "slice bounds out of range", now covered by an existing regression test). The Start >= 0 branch never received the analogous protection.

A Range: bytes=<hugeStart>- request sent to rclone serve http/webdav (or any consumer of lib/http/serve's Object(), which parses and decodes the client's own Range header) against a directory containing a symlink therefore reaches linkdst[offset:] with offset far beyond the target string's length, and Go panics with "slice bounds out of range" instead of returning an empty read.

Details

Vulnerable code (before fix):

func (o *Object) openTranslatedLink(offset, limit int64) (lrc io.ReadCloser, err error) {
    linkdst, err := os.Readlink(o.path)
    if err != nil { return nil, err }
    return readers.NewLimitedReadCloser(io.NopCloser(strings.NewReader(linkdst[offset:])), limit), nil
}

PoC

Called the real production Object.Open() on a translated-symlink object (target length 12) with &fs.RangeOption{Start: math.MaxInt64, End: -1}:

panic: runtime error: slice bounds out of range [9223372036854775807:8]
  ...backend/local.(*Object).openTranslatedLink
  ...backend/local.(*Object).Open

Impact

A remote client can send a single crafted Range header against any symlink-backed object exposed by rclone serve http/webdav/etc (backed by backend/local with --links enabled) to deterministically panic the request-handling goroutine. Go's net/http recovers panics per-connection by default, so this fails the one request/connection rather than crashing the whole server process, and no file handle is left open (the panic occurs before any read handle is acquired) - but it is fully deterministic and remotely triggerable with no authentication or race window needed, unlike some other panic-recovery findings.

Fix

Clamp offset to the length of the target string before slicing, matching how a real file read past EOF behaves (an empty read):

if offset > int64(len(linkdst)) {
    offset = int64(len(linkdst))
}

Note: the shared RangeOption.Decode() also has a related, unaddressed issue - limit = o.End - o.Start + 1 can itself overflow to a large negative number for a huge End - but a fix attempted there during this investigation broke fs/operations/reopen.go's NewReOpen, which calls Decode with its h.end field still at its zero value at that point in construction. Flagged for awareness but not changed here to keep this patch minimal and low-risk.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.75.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rclone/rclone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.75.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-88015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-10T22:49:27Z",
    "nvd_published_at": "2026-09-10T16:18:08Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nWhen `backend/local` is used with `--links`/`-l` (or the `links=true` config option), each symlink is exposed as an rclone object whose content is the target path string, suffixed `.rclonelink`. `Object.Open()` decodes an incoming `fs.RangeOption` via `Decode(o.Size())`, then for a translated-symlink object passes the decoded `offset` straight into `openTranslatedLink`, which indexes the target string directly: `linkdst[offset:]`.\n\n`RangeOption.Decode`\u0027s `Start \u003e= 0` branch (an ordinary `Range: bytes=X-` request) sets `offset = o.Start` with no upper bound, unlike its suffix-range branch (`Start \u003c 0`, e.g. `bytes=-N`), which already clamps a too-large value to 0 - the fix for a prior, related crash (issue #6310: \"bytes=-90407\" against a 5-byte object panicked with \"slice bounds out of range\", now covered by an existing regression test). The `Start \u003e= 0` branch never received the analogous protection.\n\nA `Range: bytes=\u003chugeStart\u003e-` request sent to `rclone serve http`/`webdav` (or any consumer of `lib/http/serve`\u0027s `Object()`, which parses and decodes the client\u0027s own Range header) against a directory containing a symlink therefore reaches `linkdst[offset:]` with offset far beyond the target string\u0027s length, and Go panics with \"slice bounds out of range\" instead of returning an empty read.\n\n### Details\nVulnerable code (before fix):\n```go\nfunc (o *Object) openTranslatedLink(offset, limit int64) (lrc io.ReadCloser, err error) {\n\tlinkdst, err := os.Readlink(o.path)\n\tif err != nil { return nil, err }\n\treturn readers.NewLimitedReadCloser(io.NopCloser(strings.NewReader(linkdst[offset:])), limit), nil\n}\n```\n\n### PoC\nCalled the real production `Object.Open()` on a translated-symlink object (target length 12) with `\u0026fs.RangeOption{Start: math.MaxInt64, End: -1}`:\n```\npanic: runtime error: slice bounds out of range [9223372036854775807:8]\n  ...backend/local.(*Object).openTranslatedLink\n  ...backend/local.(*Object).Open\n```\n\n### Impact\nA remote client can send a single crafted `Range` header against any symlink-backed object exposed by `rclone serve http`/`webdav`/etc (backed by `backend/local` with `--links` enabled) to deterministically panic the request-handling goroutine. Go\u0027s `net/http` recovers panics per-connection by default, so this fails the one request/connection rather than crashing the whole server process, and no file handle is left open (the panic occurs before any read handle is acquired) - but it is fully deterministic and remotely triggerable with no authentication or race window needed, unlike some other panic-recovery findings.\n\n### Fix\nClamp `offset` to the length of the target string before slicing, matching how a real file read past EOF behaves (an empty read):\n```go\nif offset \u003e int64(len(linkdst)) {\n\toffset = int64(len(linkdst))\n}\n```\nNote: the shared `RangeOption.Decode()` also has a related, unaddressed issue - `limit = o.End - o.Start + 1` can itself overflow to a large negative number for a huge `End` - but a fix attempted there during this investigation broke `fs/operations/reopen.go`\u0027s `NewReOpen`, which calls `Decode` with its `h.end` field still at its zero value at that point in construction. Flagged for awareness but not changed here to keep this patch minimal and low-risk.",
  "id": "GHSA-p6m2-r3w9-mpxw",
  "modified": "2026-09-10T22:49:27Z",
  "published": "2026-09-10T22:49:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88015"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rclone/rclone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rclone/rclone/releases/tag/v1.75.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "rclone local: crafted Range request against a translated symlink panics (DoS)"
}

ubuntu-cve-2026-88015

Vulnerability from osv_ubuntu

Published

2026-09-11 00:00

Modified

2026-09-14 08:43

Summary

Details

(rclone is a command-line program to sync files and directories to and ...)

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-88015	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-88015	REPORT
	https://github.com/rclone/rclone/security/advisor…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-ncw-rclone-dev",
            "binary_version": "1.36-3ubuntu0.2"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.36-3ubuntu0.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.36-3ubuntu0.2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.36-3",
        "1.36-3ubuntu0.1",
        "1.36-3ubuntu0.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.50.2-2ubuntu0.2+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.50.2-2ubuntu0.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.50.2-2ubuntu0.2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.47.0+ex1-6",
        "1.47.0+ex1-7",
        "1.49.5-2",
        "1.49.5-3",
        "1.50.2-2",
        "1.50.2-2ubuntu0.1",
        "1.50.2-2ubuntu0.2",
        "1.50.2-2ubuntu0.2+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.53.3-4ubuntu1.22.04.5+esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.53.3-1",
        "1.53.3-2",
        "1.53.3-4",
        "1.53.3-4ubuntu1",
        "1.53.3-4ubuntu1.22.04.1",
        "1.53.3-4ubuntu1.22.04.2",
        "1.53.3-4ubuntu1.22.04.3",
        "1.53.3-4ubuntu1.22.04.3+esm1",
        "1.53.3-4ubuntu1.22.04.4",
        "1.53.3-4ubuntu1.22.04.4+esm1",
        "1.53.3-4ubuntu1.22.04.5",
        "1.53.3-4ubuntu1.22.04.5+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.60.1+dfsg-3ubuntu0.24.04.6+esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.60.1+dfsg-2build1",
        "1.60.1+dfsg-3",
        "1.60.1+dfsg-3ubuntu0.24.04.1",
        "1.60.1+dfsg-3ubuntu0.24.04.2",
        "1.60.1+dfsg-3ubuntu0.24.04.3",
        "1.60.1+dfsg-3ubuntu0.24.04.4",
        "1.60.1+dfsg-3ubuntu0.24.04.4+esm1",
        "1.60.1+dfsg-3ubuntu0.24.04.5",
        "1.60.1+dfsg-3ubuntu0.24.04.5+esm1",
        "1.60.1+dfsg-3ubuntu0.24.04.6",
        "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "golang-github-rclone-rclone-dev",
            "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
          },
          {
            "binary_name": "rclone",
            "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "rclone",
        "purl": "pkg:deb/ubuntu/rclone@1.60.1+dfsg-4ubuntu3.2+esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.60.1+dfsg-4ubuntu2",
        "1.60.1+dfsg-4ubuntu3",
        "1.60.1+dfsg-4ubuntu3.1",
        "1.60.1+dfsg-4ubuntu3.1+esm1",
        "1.60.1+dfsg-4ubuntu3.2",
        "1.60.1+dfsg-4ubuntu3.2+esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "(rclone is a command-line program to sync files and directories to and ...)",
  "id": "UBUNTU-CVE-2026-88015",
  "modified": "2026-09-14T08:43:30Z",
  "published": "2026-09-11T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-88015"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88015"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-88015"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-88015 (GCVE-0-2026-88015)

FKIE_CVE-2026-88015

GHSA-P6M2-R3W9-MPXW

Summary

Details

PoC

Impact

Fix

ubuntu-cve-2026-88015

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature