https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 23:13:15 +0000 https://cve.radiocsirt.org/vuln/bit-rclone-2026-88015 <p><strong>Affected:</strong> Bitnami: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.</p> <p><strong>Affected:</strong> Bitnami: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.</p> https://cve.radiocsirt.org/vuln/bit-rclone-2026-88015 https://cve.radiocsirt.org/vuln/euvd-2026-366463 EUVD-2026-366463 https://cve.radiocsirt.org/vuln/euvd-2026-366463 https://cve.radiocsirt.org/vuln/fkie_cve-2026-88015 <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-88015 https://cve.radiocsirt.org/vuln/ghsa-p6m2-r3w9-mpxw <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary When `backend/local` is used with `--links`/`-l` (or the `links=true` config option), each symlink is exposed as an rclone object whose content is the target path string, suffixed `.rclonelink`. `Object.Open()` decodes an incoming `fs.RangeOption` via `Decode(o.Size())`, then for a translated-symlink object passes the decoded `offset` straight into `openTranslatedLink`, which indexes the target string directly: `linkdst[offset:]`.</p> <p>`RangeOption.Decode`&#39;s `Start &gt;= 0` branch (an ordinary `Range: bytes=X-` request) sets `offset = o.Start` with no upper bound, unlike its suffix-range branch (`Start &lt; 0`, e.g. `bytes=-N`), which already clamps a too-large value to 0 - the fix for a prior, related crash (issue #6310: &#34;bytes=-90407&#34; against a 5-byte object panicked with &#34;slice bounds out of range&#34;, now covered by an existing regression test). The `Start &gt;= 0` branch never received the analogous protection.</p> <p>A `Range: bytes=&lt;hugeStart&gt;-` request sent to `rclone serve http`/`webdav` (or any consumer of `lib/http/serve`&#39;s `Object()`, which parses and decodes the client&#39;s own Range header) against a directory containing a symlink therefore reaches `linkdst[offset:]` with offset far beyond the target string&#39;s length, and Go panics with &#34;slice bounds out of range&#34; instead of returning an empty read.</p> <p>### Details Vulnerable code (before fix): ```go func (o *Object) openTranslatedLink(offset, limit int64) (lrc io.ReadCloser, err error) { linkdst, err := os.Readlink(o.path) i…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary When `backend/local` is used with `--links`/`-l` (or the `links=true` config option), each symlink is exposed as an rclone object whose content is the target path string, suffixed `.rclonelink`. `Object.Open()` decodes an incoming `fs.RangeOption` via `Decode(o.Size())`, then for a translated-symlink object passes the decoded `offset` straight into `openTranslatedLink`, which indexes the target string directly: `linkdst[offset:]`.</p> <p>`RangeOption.Decode`&#39;s `Start &gt;= 0` branch (an ordinary `Range: bytes=X-` request) sets `offset = o.Start` with no upper bound, unlike its suffix-range branch (`Start &lt; 0`, e.g. `bytes=-N`), which already clamps a too-large value to 0 - the fix for a prior, related crash (issue #6310: &#34;bytes=-90407&#34; against a 5-byte object panicked with &#34;slice bounds out of range&#34;, now covered by an existing regression test). The `Start &gt;= 0` branch never received the analogous protection.</p> <p>A `Range: bytes=&lt;hugeStart&gt;-` request sent to `rclone serve http`/`webdav` (or any consumer of `lib/http/serve`&#39;s `Object()`, which parses and decodes the client&#39;s own Range header) against a directory containing a symlink therefore reaches `linkdst[offset:]` with offset far beyond the target string&#39;s length, and Go panics with &#34;slice bounds out of range&#34; instead of returning an empty read.</p> <p>### Details Vulnerable code (before fix): ```go func (o *Object) openTranslatedLink(offset, limit int64) (lrc io.ReadCloser, err error) { linkdst, err := os.Readlink(o.path) i…</p> https://cve.radiocsirt.org/vuln/ghsa-p6m2-r3w9-mpxw https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-88015 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone</p> <p>rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-88015