p PatchFirst

CVE-2026-79775

CVE-2026-79775 · rclone Archive Backend SquashFS Parser Denial of Service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.

CVSS 7.1 · High · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • rclone

    Versions
    • ≥ 1.72.0, ≤ 1.74.4: Affected (semver)

    No fix published

  • rclone Debian:12

    Versions
    • 1.60.1+dfsg-2
    • 1.60.1+dfsg-3
    • 1.60.1+dfsg-4
    • 1.65.0+dfsg-1
    • 1.65.0+dfsg-2
    • 1.69.3+dfsg-1
    • 1.69.3+dfsg-2
    • 1.69.3+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Debian:13

    Versions
    • 1.60.1+dfsg-4
    • 1.65.0+dfsg-1
    • 1.65.0+dfsg-2
    • 1.69.3+dfsg-1
    • 1.69.3+dfsg-2
    • 1.69.3+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:18.04:LTS

    Versions
    • 1.36-3
    • 1.36-3ubuntu0.1
    • 1.36-3ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:20.04:LTS

    Versions
    • 1.47.0+ex1-6
    • 1.47.0+ex1-7
    • 1.49.5-2
    • 1.49.5-3
    • 1.50.2-2
    • 1.50.2-2ubuntu0.1
    • 1.50.2-2ubuntu0.2
    • 1.50.2-2ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:22.04:LTS

    Versions
    • 1.53.3-1
    • 1.53.3-2
    • 1.53.3-4
    • 1.53.3-4ubuntu1
    • 1.53.3-4ubuntu1.22.04.1
    • 1.53.3-4ubuntu1.22.04.2
    • 1.53.3-4ubuntu1.22.04.3
    • 1.53.3-4ubuntu1.22.04.3+esm1
    • 1.53.3-4ubuntu1.22.04.4
    • 1.53.3-4ubuntu1.22.04.4+esm1
    • 1.53.3-4ubuntu1.22.04.5
    • 1.53.3-4ubuntu1.22.04.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:24.04:LTS

    Versions
    • 1.60.1+dfsg-2build1
    • 1.60.1+dfsg-3
    • 1.60.1+dfsg-3ubuntu0.24.04.1
    • 1.60.1+dfsg-3ubuntu0.24.04.2
    • 1.60.1+dfsg-3ubuntu0.24.04.3
    • 1.60.1+dfsg-3ubuntu0.24.04.4
    • 1.60.1+dfsg-3ubuntu0.24.04.4+esm1
    • 1.60.1+dfsg-3ubuntu0.24.04.5
    • 1.60.1+dfsg-3ubuntu0.24.04.5+esm1
    • 1.60.1+dfsg-3ubuntu0.24.04.6
    • 1.60.1+dfsg-3ubuntu0.24.04.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:26.10

    Versions
    • 1.60.1+dfsg-4ubuntu3
    • 1.69.3+dfsg-3
    • 1.69.3+dfsg-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:26.04:LTS

    Versions
    • 1.60.1+dfsg-4ubuntu2
    • 1.60.1+dfsg-4ubuntu3
    • 1.60.1+dfsg-4ubuntu3.1
    • 1.60.1+dfsg-4ubuntu3.1+esm1
    • 1.60.1+dfsg-4ubuntu3.2
    • 1.60.1+dfsg-4ubuntu3.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →