CVE-2026-88015

Katalog CVE

CVSS 5.3 · Medium EPSS 0,36%

Kerentanan Integer Overflow or Wraparound pada rclone. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Rincian

Terbit di NVD

10 September 2026

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-248: Uncaught Exception

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw advisory vendor
• https://github.com/rclone/rclone/commit/28bf49d66f94acc3f4f7f318504a706686281af9 patch
• https://github.com/rclone/rclone/releases/tag/v1.75.1 release notes