CVE-2026-88015: Request-Level Denial of Service via Go Slice Bounds Panic in rclone Local Backend
Vulnerability ID: CVE-2026-88015
CVSS Score: 5.3
Published: 2026-09-10
A request-level denial of service vulnerability exists in rclone versions prior to 1.75.1 when configured with local symlink virtualization (--links) and serving files over HTTP or WebDAV. An unauthenticated remote attacker can trigger a Go runtime slice bounds panic by sending a crafted HTTP Range request with an offset exceeding the path length of the target symlink.
TL;DR
Unauthenticated remote attackers can cause request-level denial of service in rclone servers by sending crafted HTTP Range headers targeting virtualized symlinks (.rclonelink).
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-248, CWE-190
- Attack Vector: Network (unauthenticated)
- CVSS v3.1 Score: 5.3 (Medium)
- Exploit Status: PoC available (regression tests)
- Impact: Request-level Denial of Service
- Vulnerable Component: backend/local (openTranslatedLink)
Affected Systems
- rclone HTTP Server
- rclone WebDAV Server
Mitigation Strategies
- Disable symlink exposure by ensuring the --links or -l flag is not used
- Set links = false in rclone configuration
- Upgrade rclone to version 1.75.1 or later
Remediation Steps:
- Identify running instances of rclone serve http or rclone serve webdav
- Verify if the --links or -l flag is active in execution scripts
- Download and deploy rclone 1.75.1 from the official repository
- Restart the rclone daemon to apply the update
Read the full report for CVE-2026-88015 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)