MEDIUM 5.9 GitHub
CVE-2026-71310
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
## 1. Summary
The shared HTTP CONNECT helper parses a proxy response with `http.ReadResponse` over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP-proxy hop, can grow memory until the process fails.
The security impact is process-wide exhaustion, not loss of access through the malicious proxy, which the proxy
Affected Products
- go/github.com/rclone/rclone <= 1.74.0
References
- https://github.com/advisories/GHSA-xhf4-832v-7xcr
- https://github.com/rclone/rclone/security/advisories/GHSA-xhf4-832v-7xcr
- https://github.com/rclone/rclone/commit/21d8cd3b92cd81d987f485051d454ea675d91a2b
- https://github.com/rclone/rclone/releases/tag/v1.75.0
This medium severity vulnerability with a CVSS score of 5.9 was published on 2026-08-05 via GitHub. Affected: go/github.com/rclone/rclone <= 1.74.0.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.