OPENSUSE-SU-2026:11727-1
Vulnerability from csaf_opensuse - Published: 2026-09-08 00:00 - Updated: 2026-09-16 09:06Summary
rclone-1.75.1-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: rclone-1.75.1-1.1 on GA media
Description of the patch: These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11727
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
moderate
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
8.1 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
6.1 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
7.5 (High)
Affected products
Recommended
12 products, the same list as for
CVE-2026-33818
Threats
Impact
important
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "rclone-1.75.1-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the rclone-1.75.1-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11727",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11727-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33818 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33818/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46600 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46600/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46603 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46603/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56853 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56853/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56854 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56854/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56855 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56855/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56858 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56858/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56859 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56859/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56860 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56860/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56862 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56862/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78662 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78662/"
}
],
"title": "rclone-1.75.1-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-16T09:06:42Z",
"generator": {
"date": "2026-09-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11727-1",
"initial_release_date": "2026-09-08T00:00:00Z",
"revision_history": [
{
"date": "2026-09-08T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T09:06:42Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "rclone-1.75.1-1.1.aarch64",
"product": {
"name": "rclone-1.75.1-1.1.aarch64",
"product_id": "rclone-1.75.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "rclone-bash-completion-1.75.1-1.1.aarch64",
"product": {
"name": "rclone-bash-completion-1.75.1-1.1.aarch64",
"product_id": "rclone-bash-completion-1.75.1-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "rclone-zsh-completion-1.75.1-1.1.aarch64",
"product": {
"name": "rclone-zsh-completion-1.75.1-1.1.aarch64",
"product_id": "rclone-zsh-completion-1.75.1-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rclone-1.75.1-1.1.ppc64le",
"product": {
"name": "rclone-1.75.1-1.1.ppc64le",
"product_id": "rclone-1.75.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "rclone-bash-completion-1.75.1-1.1.ppc64le",
"product": {
"name": "rclone-bash-completion-1.75.1-1.1.ppc64le",
"product_id": "rclone-bash-completion-1.75.1-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "rclone-zsh-completion-1.75.1-1.1.ppc64le",
"product": {
"name": "rclone-zsh-completion-1.75.1-1.1.ppc64le",
"product_id": "rclone-zsh-completion-1.75.1-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rclone-1.75.1-1.1.s390x",
"product": {
"name": "rclone-1.75.1-1.1.s390x",
"product_id": "rclone-1.75.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "rclone-bash-completion-1.75.1-1.1.s390x",
"product": {
"name": "rclone-bash-completion-1.75.1-1.1.s390x",
"product_id": "rclone-bash-completion-1.75.1-1.1.s390x"
}
},
{
"category": "product_version",
"name": "rclone-zsh-completion-1.75.1-1.1.s390x",
"product": {
"name": "rclone-zsh-completion-1.75.1-1.1.s390x",
"product_id": "rclone-zsh-completion-1.75.1-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rclone-1.75.1-1.1.x86_64",
"product": {
"name": "rclone-1.75.1-1.1.x86_64",
"product_id": "rclone-1.75.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "rclone-bash-completion-1.75.1-1.1.x86_64",
"product": {
"name": "rclone-bash-completion-1.75.1-1.1.x86_64",
"product_id": "rclone-bash-completion-1.75.1-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "rclone-zsh-completion-1.75.1-1.1.x86_64",
"product": {
"name": "rclone-zsh-completion-1.75.1-1.1.x86_64",
"product_id": "rclone-zsh-completion-1.75.1-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-1.75.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64"
},
"product_reference": "rclone-1.75.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-1.75.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le"
},
"product_reference": "rclone-1.75.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-1.75.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x"
},
"product_reference": "rclone-1.75.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-1.75.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64"
},
"product_reference": "rclone-1.75.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-bash-completion-1.75.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64"
},
"product_reference": "rclone-bash-completion-1.75.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-bash-completion-1.75.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le"
},
"product_reference": "rclone-bash-completion-1.75.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-bash-completion-1.75.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x"
},
"product_reference": "rclone-bash-completion-1.75.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-bash-completion-1.75.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64"
},
"product_reference": "rclone-bash-completion-1.75.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-zsh-completion-1.75.1-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64"
},
"product_reference": "rclone-zsh-completion-1.75.1-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-zsh-completion-1.75.1-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le"
},
"product_reference": "rclone-zsh-completion-1.75.1-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-zsh-completion-1.75.1-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x"
},
"product_reference": "rclone-zsh-completion-1.75.1-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rclone-zsh-completion-1.75.1-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
},
"product_reference": "rclone-zsh-completion-1.75.1-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33818",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33818"
}
],
"notes": [
{
"category": "general",
"text": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33818",
"url": "https://www.suse.com/security/cve/CVE-2026-33818"
},
{
"category": "external",
"summary": "SUSE Bug 1275034 for CVE-2026-33818",
"url": "https://bugzilla.suse.com/1275034"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-33818"
},
{
"cve": "CVE-2026-46600",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46600"
}
],
"notes": [
{
"category": "general",
"text": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46600",
"url": "https://www.suse.com/security/cve/CVE-2026-46600"
},
{
"category": "external",
"summary": "SUSE Bug 1272415 for CVE-2026-46600",
"url": "https://bugzilla.suse.com/1272415"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-46600"
},
{
"cve": "CVE-2026-46603",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46603"
}
],
"notes": [
{
"category": "general",
"text": "VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46603",
"url": "https://www.suse.com/security/cve/CVE-2026-46603"
},
{
"category": "external",
"summary": "SUSE Bug 1279547 for CVE-2026-46603",
"url": "https://bugzilla.suse.com/1279547"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-46603"
},
{
"cve": "CVE-2026-56853",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56853"
}
],
"notes": [
{
"category": "general",
"text": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56853",
"url": "https://www.suse.com/security/cve/CVE-2026-56853"
},
{
"category": "external",
"summary": "SUSE Bug 1275028 for CVE-2026-56853",
"url": "https://bugzilla.suse.com/1275028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56853"
},
{
"cve": "CVE-2026-56854",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56854"
}
],
"notes": [
{
"category": "general",
"text": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56854",
"url": "https://www.suse.com/security/cve/CVE-2026-56854"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-56854",
"url": "https://bugzilla.suse.com/1278446"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-56854",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56854"
},
{
"cve": "CVE-2026-56855",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56855"
}
],
"notes": [
{
"category": "general",
"text": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56855",
"url": "https://www.suse.com/security/cve/CVE-2026-56855"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-56855",
"url": "https://bugzilla.suse.com/1278446"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-56855",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56855"
},
{
"cve": "CVE-2026-56858",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56858"
}
],
"notes": [
{
"category": "general",
"text": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56858",
"url": "https://www.suse.com/security/cve/CVE-2026-56858"
},
{
"category": "external",
"summary": "SUSE Bug 1275033 for CVE-2026-56858",
"url": "https://bugzilla.suse.com/1275033"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-56858"
},
{
"cve": "CVE-2026-56859",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56859"
}
],
"notes": [
{
"category": "general",
"text": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56859",
"url": "https://www.suse.com/security/cve/CVE-2026-56859"
},
{
"category": "external",
"summary": "SUSE Bug 1275026 for CVE-2026-56859",
"url": "https://bugzilla.suse.com/1275026"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56859"
},
{
"cve": "CVE-2026-56860",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56860"
}
],
"notes": [
{
"category": "general",
"text": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56860",
"url": "https://www.suse.com/security/cve/CVE-2026-56860"
},
{
"category": "external",
"summary": "SUSE Bug 1275029 for CVE-2026-56860",
"url": "https://bugzilla.suse.com/1275029"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-56860"
},
{
"cve": "CVE-2026-56862",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56862"
}
],
"notes": [
{
"category": "general",
"text": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56862",
"url": "https://www.suse.com/security/cve/CVE-2026-56862"
},
{
"category": "external",
"summary": "SUSE Bug 1275032 for CVE-2026-56862",
"url": "https://bugzilla.suse.com/1275032"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56862"
},
{
"cve": "CVE-2026-78662",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78662"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a channel registered in the mux\u0027s chanList is not usable until it is established. A malicious peer was able flood the channel\u0027s incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78662",
"url": "https://www.suse.com/security/cve/CVE-2026-78662"
},
{
"category": "external",
"summary": "SUSE Bug 1278446 for CVE-2026-78662",
"url": "https://bugzilla.suse.com/1278446"
},
{
"category": "external",
"summary": "SUSE Bug 1280553 for CVE-2026-78662",
"url": "https://bugzilla.suse.com/1280553"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:rclone-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-bash-completion-1.75.1-1.1.x86_64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.aarch64",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.ppc64le",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.s390x",
"openSUSE Tumbleweed:rclone-zsh-completion-1.75.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-08T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-78662"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…