https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:07:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-79775 <p><strong>Affected:</strong> rclone</p> <p>rclone versions &gt;= v1.72.0 and &lt;= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend&#39;s SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via &#39;rclone serve sftp&#39;, can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.</p> <p><strong>Affected:</strong> rclone</p> <p>rclone versions &gt;= v1.72.0 and &lt;= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend&#39;s SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via &#39;rclone serve sftp&#39;, can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.</p> https://vulnerability.circl.lu/vuln/cve-2026-79775