DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-3X6R-WXXG-53VV: GHSA-3x6r-wxxg-53vv: Process-Fatal Nil Pointer Dereference in rclone WebDAV TUS Upload Backend

#security #cve #cybersecurity #ghsa

GHSA-3x6r-wxxg-53vv: Process-Fatal Nil Pointer Dereference in rclone WebDAV TUS Upload Backend

Vulnerability ID: GHSA-3X6R-WXXG-53VV
CVSS Score: 5.3
Published: 2026-08-05

A critical process-fatal NULL pointer dereference vulnerability exists in the WebDAV backend of rclone (when configured with ownCloud Infinite Scale TUS uploads). During transport failures, a nil HTTP response pointer is dereferenced directly without validation, leading to an unhandled Go runtime panic that terminates the entire rclone daemon. This vulnerability was resolved in rclone version 1.75.0.

TL;DR

Uncaught nil-pointer dereference in rclone's WebDAV backend causes immediate process-wide crashes (denial of service) when a TUS upload encounters a pre-response transport or network failure.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-476 (NULL Pointer Dereference) / CWE-248 (Uncaught Exception)
  • Attack Vector: Network
  • CVSS v3.1: 5.3 (Medium)
  • EPSS Score: N/A (No CVE assigned)
  • Impact: Application crash / Denial of Service (DoS)
  • Exploit Status: Proof-of-Concept / Local Reproducer
  • KEV Status: Not listed

Affected Systems

  • rclone with ownCloud Infinite Scale WebDAV backend using TUS uploads
  • rclone: <= 1.74.0 (Fixed in: 1.75.0)

Code Analysis

Commit: 5871d98

webdav: tus: fix potential nil pointer crash GHSA-3x6r-wxxg-53vv

--- a/backend/webdav/tus.go
+++ b/backend/webdav/tus.go
@@ -44,14 +44,18 @@ func (o *Object) updateViaTus(ctx context.Context, in io.Reader, contentType str

 func (f *Fs) getTusLocationOrRetry(ctx context.Context, resp *http.Response, err error) (bool, string, error) {

-   switch resp.StatusCode {
-   case 201:
-       location := resp.Header.Get("Location")
-       return false, location, nil
-   case 412:
-       return false, "", ErrVersionMismatch
-   case 413:
-       return false, "", ErrLargeUpload
+   // resp is nil if the HTTP transaction failed before a response
+   // was received, eg on connection refused or reset
+   if resp != nil {
+       switch resp.StatusCode {
+       case 201:
+           location := resp.Header.Get("Location")
+           return false, location, nil
+       case 412:
+           return false, "", ErrVersionMismatch
+       case 413:
+           return false, "", ErrLargeUpload
+       }
    }

    retry, err := f.shouldRetry(ctx, resp, err)
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Advisory containing proof of concept reproduction vectors and detailed discussion.

Mitigation Strategies

  • Upgrade rclone to version 1.75.0 or later.
  • Disable ownCloud Infinite Scale TUS-based transfers on untrusted networks or avoid uploading to unverified WebDAV endpoints if upgrading is delayed.
  • Implement local process monitoring daemons (systemd, supervisord) to handle automatic recovery of crashed rclone mounts.

Remediation Steps:

  1. Identify running rclone daemon and mount instances using command: ps aux | grep rclone
  2. Download and install rclone version 1.75.0 or later from the official repository.
  3. Restart all active rclone mounts or background syncing daemons to apply the patched binary.
  4. Verify stability by running rclone against an inactive local port to ensure it fails gracefully without panicking.

References

Read the full report for GHSA-3X6R-WXXG-53VV on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)