Every CVE Search/ Get API key

CVE-2026-88015

rclone local: crafted Range request against a translated symlink panics (DoS)

5.3 MediumFix available

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.36%Unchanged since Sep 11, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
CVE-2026-88015
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-248
Updated
2026-11-02
EUVDEUVD-2026-75575 5.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
EUVD-2026-75575
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-p6m2-r3w9-mpxw 5.3

rclone local: crafted Range request against a translated symlink panics (DoS)

Summary

When backend/local is used with --links/-l (or the links=true config option), each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open() decodes an incoming fs.RangeOption via Decode(o.Size()), then for a translated-symlink object passes the decoded offset straight into openTranslatedLink, which indexes the target string directly: linkdst[offset:].

RangeOption.Decode's Start >= 0 branch (an ordinary Range: bytes=X- request) sets offset = o.Start with no upper bound, unlike its suffix-range branch (Start < 0, e.g. bytes=-N), which already clamps a too-large value to 0 - the fix for a prior, related crash (issue #6310: "bytes=-90407" against a 5-byte object panicked with "slice bounds out of range", now covered by an existing regression test). The Start >= 0 branch never received the analogous protection.

A Range: bytes=<hugeStart>- request sent to rclone serve http/webdav (or any consumer of lib/http/serve's Object(), which parses and decodes the client's own Range header) against a directory containing a symlink therefore reaches linkdst[offset:] with offset far beyond the target string's length, and Go panics with "slice bounds out of range" instead of returning an empty read.

Details

Vulnerable code (before fix):

func (o *Object) openTranslatedLink(offset, limit int64) (lrc io.ReadCloser, err error) {
	linkdst, err := os.Readlink(o.path)
	if err != nil { return nil, err }
	return readers.NewLimitedReadCloser(io.NopCloser(strings.NewReader(linkdst[offset:])), limit), nil
}

PoC

Called the real production Object.Open() on a translated-symlink object (target length 12) with &fs.RangeOption{Start: math.MaxInt64, End: -1}:

panic: runtime error: slice bounds out of range [9223372036854775807:8]
  ...backend/local.(*Object).openTranslatedLink
  ...backend/local.(*Object).Open

Impact

A remote client can send a single crafted Range header against any symlink-backed object exposed by rclone serve http/webdav/etc (backed by backend/local with --links enabled) to deterministically panic the request-handling goroutine. Go's net/http recovers panics per-connection by default, so this fails the one request/connection rather than crashing the whole server process, and no file handle is left open (the panic occurs before any read handle is acquired) - but it is fully deterministic and remotely triggerable with no authentication or race window needed, unlike some other panic-recovery findings.

Fix

Clamp offset to the length of the target string before slicing, matching how a real file read past EOF behaves (an empty read):

if offset > int64(len(linkdst)) {
	offset = int64(len(linkdst))
}

Note: the shared RangeOption.Decode() also has a related, unaddressed issue - limit = o.End - o.Start + 1 can itself overflow to a large negative number for a huge End - but a fix attempted there during this investigation broke fs/operations/reopen.go's NewReOpen, which calls Decode with its h.end field still at its zero value at that point in construction. Flagged for awareness but not changed here to keep this patch minimal and low-risk.

Record
GHSA-p6m2-r3w9-mpxw
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-248
Updated
2026-11-02
NVD 5.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
CVE-2026-88015
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-248
Updated
2026-11-02
OSV 5.3

rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
CVE-2026-88015
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-248
Updated
2026-11-02
OSVDEBIAN-CVE-2026-88015 5.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
DEBIAN-CVE-2026-88015
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-p6m2-r3w9-mpxw 5.3

rclone local: crafted Range request against a translated symlink panics (DoS)

Summary

When backend/local is used with --links/-l (or the links=true config option), each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open() decodes an incoming fs.RangeOption via Decode(o.Size()), then for a translated-symlink object passes the decoded offset straight into openTranslatedLink, which indexes the target string directly: linkdst[offset:].

RangeOption.Decode's Start >= 0 branch (an ordinary Range: bytes=X- request) sets offset = o.Start with no upper bound, unlike its suffix-range branch (Start < 0, e.g. bytes=-N), which already clamps a too-large value to 0 - the fix for a prior, related crash (issue #6310: "bytes=-90407" against a 5-byte object panicked with "slice bounds out of range", now covered by an existing regression test). The Start >= 0 branch never received the analogous protection.

A Range: bytes=<hugeStart>- request sent to rclone serve http/webdav (or any consumer of lib/http/serve's Object(), which parses and decodes the client's own Range header) against a directory containing a symlink therefore reaches linkdst[offset:] with offset far beyond the target string's length, and Go panics with "slice bounds out of range" instead of returning an empty read.

Details

Vulnerable code (before fix):

func (o *Object) openTranslatedLink(offset, limit int64) (lrc io.ReadCloser, err error) {
	linkdst, err := os.Readlink(o.path)
	if err != nil { return nil, err }
	return readers.NewLimitedReadCloser(io.NopCloser(strings.NewReader(linkdst[offset:])), limit), nil
}

PoC

Called the real production Object.Open() on a translated-symlink object (target length 12) with &fs.RangeOption{Start: math.MaxInt64, End: -1}:

panic: runtime error: slice bounds out of range [9223372036854775807:8]
  ...backend/local.(*Object).openTranslatedLink
  ...backend/local.(*Object).Open

Impact

A remote client can send a single crafted Range header against any symlink-backed object exposed by rclone serve http/webdav/etc (backed by backend/local with --links enabled) to deterministically panic the request-handling goroutine. Go's net/http recovers panics per-connection by default, so this fails the one request/connection rather than crashing the whole server process, and no file handle is left open (the panic occurs before any read handle is acquired) - but it is fully deterministic and remotely triggerable with no authentication or race window needed, unlike some other panic-recovery findings.

Fix

Clamp offset to the length of the target string before slicing, matching how a real file read past EOF behaves (an empty read):

if offset > int64(len(linkdst)) {
	offset = int64(len(linkdst))
}

Note: the shared RangeOption.Decode() also has a related, unaddressed issue - limit = o.End - o.Start + 1 can itself overflow to a large negative number for a huge End - but a fix attempted there during this investigation broke fs/operations/reopen.go's NewReOpen, which calls Decode with its h.end field still at its zero value at that point in construction. Flagged for awareness but not changed here to keep this patch minimal and low-risk.

Record
GHSA-p6m2-r3w9-mpxw
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-190, CWE-248
Updated
2026-11-02
OSVUBUNTU-CVE-2026-88015 5.3

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
UBUNTU-CVE-2026-88015
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBIT-rclone-2026-88015 No score

rclone local: crafted Range request against a translated symlink panics (DoS)

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing request-level denial of service rather than terminating the entire process. This issue is fixed in version 1.75.1.

Record
BIT-rclone-2026-88015
Updated
2026-11-02
OSVGO-2026-6461 No score

rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

Record
GO-2026-6461
Updated
2026-11-02
OSVopenSUSE-SU-2026:21897-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
openSUSE-SU-2026:21897-1
Updated
2026-11-02
OSVSUSE-SU-2026:23855-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23855-1
Updated
2026-11-02
OSVSUSE-SU-2026:23863-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Changes for govulncheck-vulndb:

  • Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc
  • GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m
  • GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp
  • GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp
  • GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3
  • GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj
  • GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv
  • GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x
  • GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9
  • GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2
  • GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5
  • GO-2026-6449 GHSA-hxjg-93wc-h8p8
  • GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg
  • GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp
  • GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf
  • GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc
  • GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c
  • GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c
  • GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f
  • GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq
  • GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77
  • GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh
  • GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj
  • GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw
  • GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c
  • GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r
  • GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q
  • GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724
  • GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv
  • GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x
  • GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326
  • GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx
  • GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79
  • GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p
  • GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v
  • Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.
  • GO-2026-6302 GHSA-mf7q-r4rv-jv94
  • GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x
  • GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf
  • GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv
  • GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf
  • GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v
  • GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82
  • GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg
  • GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88
  • GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq
  • GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx
  • GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39
  • GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g
  • GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq
  • GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m
  • GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v
  • GO-2026-6364 GHSA-99rq-75j6-5j9f
  • GO-2026-6365 GHSA-gw25-m53r-qh88
  • GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r
  • GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv
  • GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm
  • GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945
  • GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2
  • GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w
  • GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66
  • GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7
  • GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r
  • GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7
  • GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6
  • GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc
  • GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9
  • GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm
  • GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv
  • GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq
  • GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9
  • GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v
  • GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2
  • GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc
  • GO-2026-6404 CVE-2026-72803…
Record
SUSE-SU-2026:23863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/rclone/rclone
Go
 through 1.75.0
1.75.1
rclone
Bitnami
 before 1.75.1
1.75.1
rclone
Debian:12
 All versions, plus listed versions
1.60.1+dfsg-21.60.1+dfsg-31.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
rclone
Debian:13
 All versions, plus listed versions
1.60.1+dfsg-41.65.0+dfsg-11.65.0+dfsg-21.69.3+dfsg-11.69.3+dfsg-21.69.3+dfsg-3
 None known
github.com/rclone/rclone
Go
 before 1.75.1
1.75.1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1
rclone
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.36-31.36-3ubuntu0.11.36-3ubuntu0.2
 None known
rclone
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.47.0+ex1-61.47.0+ex1-71.49.5-21.49.5-31.50.2-21.50.2-2ubuntu0.11.50.2-2ubuntu0.21.50.2-2ubuntu0.2+esm1
 None known
rclone
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.53.3-11.53.3-21.53.3-41.53.3-4ubuntu11.53.3-4ubuntu1.22.04.1
Show 7 moreShow less
1.53.3-4ubuntu1.22.04.21.53.3-4ubuntu1.22.04.31.53.3-4ubuntu1.22.04.3+esm11.53.3-4ubuntu1.22.04.41.53.3-4ubuntu1.22.04.4+esm11.53.3-4ubuntu1.22.04.51.53.3-4ubuntu1.22.04.5+esm1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
rclone
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.60.1+dfsg-2build11.60.1+dfsg-31.60.1+dfsg-3ubuntu0.24.04.11.60.1+dfsg-3ubuntu0.24.04.21.60.1+dfsg-3ubuntu0.24.04.3
Show 6 moreShow less
1.60.1+dfsg-3ubuntu0.24.04.41.60.1+dfsg-3ubuntu0.24.04.4+esm11.60.1+dfsg-3ubuntu0.24.04.51.60.1+dfsg-3ubuntu0.24.04.5+esm11.60.1+dfsg-3ubuntu0.24.04.61.60.1+dfsg-3ubuntu0.24.04.6+esm1
 None known
rclone
Ubuntu:26.10
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu31.69.3+dfsg-31.69.3+dfsg-3ubuntu1
 None known
rclone
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1.60.1+dfsg-4ubuntu21.60.1+dfsg-4ubuntu31.60.1+dfsg-4ubuntu3.11.60.1+dfsg-4ubuntu3.1+esm11.60.1+dfsg-4ubuntu3.21.60.1+dfsg-4ubuntu3.2+esm1
 None known
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 91 CVEs
 before 0.0.20260916T180043-160000.1.1
0.0.20260916T180043-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88015 is a medium vulnerability (CVSS 5.3) in Rclone, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in github.com/rclone/rclone 1.75.1.

References

Show 97 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open