Technical impact
The vulnerability stems from the handling of HTTP CONNECT response headers within rclone’s proxy helper; unbounded header parsing via an unlimited buffered reader allows a proxy—either malicious or compromised—to send excessively large headers that grow memory usage until the rclone process crashes. The primary impact is a denial of service caused by uncontrolled memory consumption, affecting any user running rclone against FTP or SFTP services that route through a proxy. weakness aligns with CWE‑400 (Unvalidated Input) and CWE‑770 (Memory Leak).
Affected Systems
All installations of rclone older than version 1.75.0 are affected, regardless of operating system or architecture. The flaw resides in the shared http.go proxy helper used by FTP and SFTP connections, including the SFTP parser that operates before SSH server authentication, so target host key validation does not constrain a malicious proxy.
Risk and Exploitability
With a CVSS score of 5.9, the vulnerability is considered moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector involves an attacker who can control or compromise an HTTP proxy that rclone communicates through; by instructing the proxy to send oversized headers, the attacker can trigger resource exhaustion and terminate the rclone process. The risk remains higher in environments that use untrusted or publicly exposed proxies for FTP/SFTP transfers.
Github GHSA