CVE-2026-71310— Rclone 资源管理错误漏洞

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

未加控制的资源消耗(资源穷尽)

Rclone 资源管理错误漏洞

Rclone是Rclone团队开源的一个支持多协议的数据同步工具。 Rclone 1.75.0之前版本存在资源管理错误漏洞，该漏洞源于lib/proxy/http.go中的共享HTTP CONNECT helper使用http.ReadResponse解析代理CONNECT响应时未限制缓冲读取器，可能允许恶意代理发送超大标头导致内存增长直至rclone进程失败。

N/A

N/A