CVE-2026-79778 — rclone before v1.75.0 Denial of Service via TUS nil-response panic
rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A mali…
Published: 2026-08-25 · CVSS: 6.0 · CVSS 4.0
rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7