rclone implements the WebDAV TUS protocol to allow resumable uploads. In versions prior to v1.75.0, the creation handler dereferences a nil response before checking for transport errors, demonstrating unchecked return handling (CWE‑248) and a nil pointer dereference (CWE‑476). This dereference triggers a panic that terminates unhandled goroutines and can halt unrelated long‑lived processes, resulting in a denial of service for any user relying on the process for other tasks.

The vulnerability affects rclone packages from the "rclone:rclone" vendor. All releases before version 1.75.0 are impacted; users must update to v1.75.0 or later.

The CVSS score of 6.0 indicates moderate severity, and the EPSS score is <1%, so exploitation likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalog. A malicious or compromised endpoint can press reset connections during TUS uploads to trigger the panic. The attack likely requires network access to a configured TUS endpoint, which could be reachable over the public internet.