{"id":"CVE-2026-41179","aliases":["ALPINE-CVE-2026-41179","BIT-rclone-2026-41179","DEBIAN-CVE-2026-41179","EUVD-2026-25144","GHSA-jfwf-28xr-xw6q","GO-2026-5466","JLSEC-2026-281","MGASA-2026-0147","ROOT-APP-GOBINARY-CVE-2026-41179","SUSE-SU-2026:23625-1","UBUNTU-CVE-2026-41179","openSUSE-SU-2026:10584-1","openSUSE-SU-2026:20620-1","openSUSE-SU-2026:21436-1","openSUSE-SU-2026:21761-1"],"status":"published","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.08585,"percentile":0.95121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-306","CWE-78","CWE-94"],"published":"2026-04-20T00:00:00Z","modified":"2026-11-03T06:33:02Z","exploits":[{"source":"pocgithub","id":"pssec-io/CVE-2026-41179","title":"pssec-io/CVE-2026-41179","date":"2026-06-28","url":"https://github.com/pssec-io/CVE-2026-41179"},{"source":"pocgithub","id":"s-vx/CVE-2026-41179","title":"s-vx/CVE-2026-41179","date":"2026-07-27","url":"https://github.com/s-vx/CVE-2026-41179"},{"source":"nuclei","id":"CVE-2026-41179","title":"RClone RC - Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-41179.yaml"}],"fixes":[{"ecosystem":"Go","package":"github.com/rclone/rclone","fixed_in":["1.73.5"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"rclone","fixed_in":["1.73.5-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"rclone","fixed_in":["1.73.5"],"sources":["osv"]},{"ecosystem":"Julia","package":"Rclone_jll","fixed_in":["1.73.5+0"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/rclone/rclone","fixed_in":["v1.69.3-root.io.1","v1.69.3-root.io.2","v1.69.3-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/rclone/rclone","fixed_in":["v1.69.3-aikido.2","v1.69.3-aikido.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rclone","fixed_in":["1.60.1+dfsg-3ubuntu0.24.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rclone","fixed_in":["1.60.1+dfsg-4ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rclone","fixed_in":["1.60.1+dfsg-4ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.48.0"},{"last_affected":"1.73.4"},{"fixed":"1.73.5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.48.0"},{"fixed":"1.73.5-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.48.0"},{"fixed":"1.73.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-2","1.60.1+dfsg-3","1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.48.0"},{"fixed":"1.73.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/ncw/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.48.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.49.0"},{"fixed":"1.73.5"}]}]},{"source":"osv","ecosystem":"Julia","package":"Rclone_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.73.5+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73.5-1.1.mga9"}]}],"bundled":31},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.69.3-root.io.1"},{"fixed":"v1.69.3-root.io.2"},{"fixed":"v1.69.3-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.69.3-aikido.2"},{"fixed":"v1.69.3-aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-3ubuntu0.24.04.5"}]}],"versions":["1.60.1+dfsg-2build1","1.60.1+dfsg-3","1.60.1+dfsg-3ubuntu0.24.04.1","1.60.1+dfsg-3ubuntu0.24.04.2","1.60.1+dfsg-3ubuntu0.24.04.3","1.60.1+dfsg-3ubuntu0.24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-4ubuntu2.1"}]}],"versions":["1.60.1+dfsg-4","1.60.1+dfsg-4ubuntu1","1.60.1+dfsg-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4ubuntu3","1.69.3+dfsg-3","1.69.3+dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-4ubuntu3.1"}]}],"versions":["1.60.1+dfsg-4ubuntu2","1.60.1+dfsg-4ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.73.5-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.4-bp160.1.1"}]}],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260827T195228-160000.1.1"}]}],"bundled":181}],"products":[{"vendor":"rclone","product":"rclone"},{"vendor":"red hat","product":"openshift api for data protection"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"}],"references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/rclone/rclone/releases/tag/v1.73.5","tags":["x_refsource_MISC","web"]},{"url":"https://rclone.org/changelog/#v1-73-5-2026-04-19","tags":["x_refsource_MISC","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41179","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460988","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41179","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jfwf-28xr-xw6q","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41179","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41179.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41179","tags":["advisory"]},{"url":"https://github.com/rclone/rclone","tags":["package"]},{"url":"https://github.com/rclone/rclone/commit/9e3e68d00c3ecf475a1432fc206400cfb4df7e3f","tags":["fix"]},{"url":"https://advisories.mageia.org/MGASA-2026-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33808","tags":["report"]},{"url":"https://rclone.org/changelog/#v1-73-4-2026-04-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-3-2026-03-23","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-2-2026-03-06","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-1-2026-02-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-73-0-2026-01-30","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-72-1-2025-12-10","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-72-0-2025-11-21","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-2-2025-10-20","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-1-2025-09-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-71-0-2025-08-22","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-3-2025-07-09","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-2-2025-06-27","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-1-2025-06-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-70-0-2025-06-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-3-2025-05-21","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-2-2025-05-01","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-1-2025-02-14","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-69-0-2025-01-12","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-2-2024-11-15","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-1-2024-09-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-68-0-2024-09-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-67-0-2024-06-14","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-66-0-2024-03-10","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-2-2024-01-24","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-1-2024-01-08","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-65-0-2023-11-26","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-2-2023-10-19","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-1-2023-10-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-64-0-2023-09-11","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-63-1-2023-07-17","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-63-0-2023-06-30","tags":["web"]},{"url":"https://rclone.org/changelog/#v1-62-2-2023-03-16","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623625-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-10722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77354","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-41179","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41179","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8299-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41176","tags":["web"]},{"url":"https://bugzilla.suse.com/1232964","tags":["report"]},{"url":"https://bugzilla.suse.com/1233422","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33186","tags":["web"]},{"url":"https://bugzilla.suse.com/1262438","tags":["report"]},{"url":"https://bugzilla.suse.com/1262439","tags":["report"]},{"url":"https://bugzilla.suse.com/1266210","tags":["report"]},{"url":"https://bugzilla.suse.com/1267192","tags":["report"]},{"url":"https://bugzilla.suse.com/1267869","tags":["report"]},{"url":"https://bugzilla.suse.com/1271056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-41179","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:03:36.282Z","modified":"2026-07-15T00:59:47.559Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78","CWE-306","CWE-94"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-25144","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:03:36Z","modified":"2026-07-15T00:59:47Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-jfwf-28xr-xw6q","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"### Summary\nThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.\n\n### Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n\n\n### Details\nThe root cause consists of the following pieces:\n\n1. `operations/fsinfo` is not protected with `AuthRequired: true`\n2. `operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input\n3. `rc.GetFs(...)` supports inline backend creation through object-valued `fs`\n4. WebDAV backend initialization executes `bearer_token_command`\n\nRelevant code paths:\n\n- [`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)\n  - `operations/fsinfo` is registered without `AuthRequired: true`\n  - `rcFsInfo()` calls `rc.GetFs(ctx, in)`\n\n- [`fs/rc/cache.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go)\n  - `GetFs()` / `GetFsNamed()` can parse an object-valued `fs`\n  - `getConfigMap()` converts attacker-controlled JSON into a backend config string\n\n- [`backend/webdav/webdav.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go)\n  - `bearer_token_command` is a supported backend option\n  - `NewFs(...)` calls `fetchAndSetBearerToken()` when `bearer_token_command` is set\n  - `fetchBearerToken()` invokes `exec.Command(...)`\n\nThis creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.\n\nThis was alidated on:\n- current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`\n- latest public release tested locally: `v1.73.4`\n\nThis was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).\n\n### PoC\n#### Minimal single-request form PoC\nStart a vulnerable RC server:\n\n```bash\nrclone rcd --rc-addr 127.0.0.1:5572\n```\n\nNo `--rc-user`, no `--rc-pass`, no `--rc-htpasswd`.\n\nThen send a single request:\n\n```bash\ncurl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \\\n  --data-urlencode \"fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':\"\n```\n\nExpected result:\n- HTTP 200 JSON response from `operations/fsinfo`\n- `/tmp/rclone_fsinfo_rce_poc_marker` is created on the host\n\n### Impact\nThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.\n\nIn practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.\n\n#### Testing performed\nThis was successfully reproduced:\n- on a local test environment\n- on a public amd64 Ubuntu host controlled by the tester\n\nOn the public host it was confirmed:\n\n- the unauthenticated `operations/fsinfo` exploit worked\n- command execution occurred on the host\n- the issue was reproducible through direct host execution","status":"published","published":"2026-04-22T14:45:10Z","modified":"2026-05-20T01:36:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"nvd":[{"id":"CVE-2026-41179","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:16:45.947Z","modified":"2026-07-15T02:21:14.09Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78","CWE-306","CWE-94"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"ALPINE-CVE-2026-41179","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:16:45.947Z","modified":"2026-11-03T06:33:02.714631217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-41179","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:03:36.282Z","modified":"2026-10-28T02:30:54.627743713Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-41179","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:16:45.947Z","modified":"2026-10-01T03:03:11.684090035Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-jfwf-28xr-xw6q","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"### Summary\nThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.\n\n### Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n\n\n### Details\nThe root cause consists of the following pieces:\n\n1. `operations/fsinfo` is not protected with `AuthRequired: true`\n2. `operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input\n3. `rc.GetFs(...)` supports inline backend creation through object-valued `fs`\n4. WebDAV backend initialization executes `bearer_token_command`\n\nRelevant code paths:\n\n- [`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)\n  - `operations/fsinfo` is registered without `AuthRequired: true`\n  - `rcFsInfo()` calls `rc.GetFs(ctx, in)`\n\n- [`fs/rc/cache.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go)\n  - `GetFs()` / `GetFsNamed()` can parse an object-valued `fs`\n  - `getConfigMap()` converts attacker-controlled JSON into a backend config string\n\n- [`backend/webdav/webdav.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go)\n  - `bearer_token_command` is a supported backend option\n  - `NewFs(...)` calls `fetchAndSetBearerToken()` when `bearer_token_command` is set\n  - `fetchBearerToken()` invokes `exec.Command(...)`\n\nThis creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.\n\nThis was alidated on:\n- current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`\n- latest public release tested locally: `v1.73.4`\n\nThis was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).\n\n### PoC\n#### Minimal single-request form PoC\nStart a vulnerable RC server:\n\n```bash\nrclone rcd --rc-addr 127.0.0.1:5572\n```\n\nNo `--rc-user`, no `--rc-pass`, no `--rc-htpasswd`.\n\nThen send a single request:\n\n```bash\ncurl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \\\n  --data-urlencode \"fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':\"\n```\n\nExpected result:\n- HTTP 200 JSON response from `operations/fsinfo`\n- `/tmp/rclone_fsinfo_rce_poc_marker` is created on the host\n\n### Impact\nThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.\n\nIn practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.\n\n#### Testing performed\nThis was successfully reproduced:\n- on a local test environment\n- on a public amd64 Ubuntu host controlled by the tester\n\nOn the public host it was confirmed:\n\n- the unauthenticated `operations/fsinfo` exploit worked\n- command execution occurred on the host\n- the issue was reproducible through direct host execution","status":"published","published":"2026-04-22T14:45:10Z","modified":"2026-09-10T03:50:44.588707843Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"JLSEC-2026-281","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"### Summary\n\nThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.\n\n### Preconditions\n\nPreconditions for this vulnerability are:\n\n  - The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n  - The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n  - The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n\n### Details\n\nThe root cause consists of the following pieces:\n\n 1. `operations/fsinfo` is not protected with `AuthRequired: true`\n 2. `operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input\n 3. `rc.GetFs(...)` supports inline backend creation through object-valued `fs`\n 4. WebDAV backend initialization executes `bearer_token_command`\n\nRelevant code paths:\n\n  - [`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)\n    \n      + `operations/fsinfo` is registered without `AuthRequired: true`\n      + `rcFsInfo()` calls `rc.GetFs(ctx, in)`\n\n  - [`fs/rc/cache.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go)\n    \n      + `GetFs()` / `GetFsNamed()` can parse an object-valued `fs`\n      + `getConfigMap()` converts attacker-controlled JSON into a backend config string\n  - [`backend/webdav/webdav.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go)\n    \n      + `bearer_token_command` is a supported backend option\n      + `NewFs(...)` calls `fetchAndSetBearerToken()` when `bearer_token_command` is set\n      + `fetchBearerToken()` invokes `exec.Command(...)`\n\nThis creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.\n\nThis was alidated on:\n\n  - current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`\n  - latest public release tested locally: `v1.73.4`\n\nThis was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).\n\n### PoC\n\n#### Minimal single-request form PoC\n\nStart a vulnerable RC server:\n\n```bash\nrclone rcd --rc-addr 127.0.0.1:5572\n```\n\nNo `--rc-user`, no `--rc-pass`, no `--rc-htpasswd`.\n\nThen send a single request:\n\n```bash\ncurl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \\\n  --data-urlencode \"fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':\"\n```\n\nExpected result:\n\n  - HTTP 200 JSON response from `operations/fsinfo`\n  - `/tmp/rclone_fsinfo_rce_poc_marker` is created on the host\n\n### Impact\n\nThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.\n\nIn practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.\n\n#### Testing performed\n\nThis was successfully reproduced:\n\n  - on a local test environment\n  - on a public amd64 Ubuntu host controlled by the tester\n\nOn the public host it was confirmed:\n\n  - the unauthenticated `operations/fsinfo` exploit worked\n  - command execution occurred on the host\n  - the issue was reproducible through direct host execution","status":"published","published":"2026-04-27T20:35:04.206Z","modified":"2026-07-18T00:00:36.354676203Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-41179","title":"CVE-2026-41179 in rootio-github.com/rclone/rclone - Patched by Root","description":"Root has patched CVE-2026-41179 in the rootio-github.com/rclone/rclone package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-06-29T12:19:55Z","modified":"2026-06-29T20:00:13.125667182Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-41179","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-23T00:16:00Z","modified":"2026-10-17T12:58:14.8912924Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"BIT-rclone-2026-41179","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","status":"published","published":"2026-04-24T08:51:09.638Z","modified":"2026-09-08T08:48:18.929569968Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"GO-2026-5466","title":"Unauthenticated backend instantiation in github.com/rclone/rclone","description":"The operations/fsinfo remote control (RC) endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it (e.g., via bearer_token_command in webdav or ssh in sftp).","status":"published","published":"2026-08-11T20:19:48Z","modified":"2026-08-14T15:42:03.369271133Z","updated_at":"2026-11-02T15:47:02.556545Z"},{"id":"MGASA-2026-0147","title":"Updated rclone packages fix security vulnerabilities","description":"This update bring new features, bugs and vulnerabilities fixed in rclone\nand golang components used to build it.\n","status":"published","published":"2026-05-18T19:12:53Z","modified":"2026-05-18T19:33:24.032777418Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10584-1","title":"rclone-1.73.5-1.1 on GA media","description":"These are all security issues fixed in the rclone-1.73.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-20T00:00:00Z","modified":"2026-04-21T08:16:08.355514Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20620-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.73.5:\n  * Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * iclouddrive: fix 'directory not found' error when the directory contains accent marks\n  * Start v1.73.5-DEV development\n\n- Update to version 1.73.4:\n  * Version v1.73.4\n  * Update to go 1.25.9 to fix multiple CVEs\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * fix(docs): Fix link to not be language specific\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Start v1.73.4-DEV development\n\n- Update to version 1.73.3: (CVE-2026-33186 GHSA-6g7g-w4f8-9c9x)\n  * Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * docs: added text to the label showing version-introduced info\n  * Start v1.73.3-DEV development\n  * docs: update sponsors\n\n- Update to version 1.73.2:\n  * Version v1.73.2\n  * Update to go 1.25.8 to fix multiple CVEs\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * docs: fix new drive flag typo in changelog\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * docs: note that --use-server-modtime only works on some backends\n  * internxt: fix Entry doesn't belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * docs: Fix headers hierarchy for mount.md\n  * webdav: escape reserved characters in URL path segments\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * docs: add instructions on how to update Go version\n  * buid: update github.com/cloudflare/circl to v1.6.3 to fix CVE-2026-1229\n  * Start v1.73.2-DEV development\n\n- Update to version 1.73.1:\n  * Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * Start v1.73.1-DEV development\n\n- Update to version 1.73.0:\n  * Version v1.73.0\n  * drive: fix crash when trying to creating shortcut to a Google doc\n  * azureblob,azurefiles: factor the common auth into a library\n  * test: allow backends to return fs.ErrorCantListRoot to skip Root tests\n  * build: add privatebeta Makefile target\n  * docs: add Internxt as a sponsor\n  * internxt: remove use of CVE laden github.com/disintegration/imaging\n  * docs: fix Internxt docs after merge\n  * docs: update making a new backend docs\n  * docs: build overview page from the backend data\n  * docs: add tiering to the documentation - fixes #8873\n  * docs: add data about each backend in YAML format\n  * docs: add bin/manage_backends.py for managing the backend data files\n  * internxt: use rclone's http.Client to enable more features\n  * internxt: fix lint problems\n  * Add StarHack to contributors\n  * Add lullius to contributors\n  * Add jzunigax2 to contributors\n  * internxt: add Internxt backend - fixes #7610\n  * drive: add --drive-metadata-force-expansive-access flag - Fixes #8980\n  * test_all: allow drime more time to complete\n  * onedrive: fix permissions on onedrive Personal\n  * onedrive: fix require sign in for Onedrive Personal\n  * onedrive: Onedrive Personal no longer supports description\n  * onedrive: fix setting modification time on directories for onedrive Personal\n  * onedrive: fix cancelling multipart upload\n  * docs: fix WinFsp link in mount documentation\n  * cmount: make work under OpenBSD - fixes #1727\n  * vfs: make mount tests run on OpenBSD\n  * docs: improve alignment of icons\n  * protondrive: update to use forks of upstream modules\n  * Add hyusap to contributors\n  * Add Nick Owens to contributors\n  * Add Mikel Olasagasti Uranga to contributors\n  * docs: fix googlephotos custom client_id instructions\n  * cmount: fix OpenBSD mount support.\n  * fs: fix bwlimit: correctly report minutes\n  * fs: fix bwlimit: use %d instead of %q for ints\n  * mega: reverts TLS workaround\n  * docs: fix formatting\n  * docs: add faq entry about re-enabling old TLS ciphers\n  * Add Marc-Philip to contributors\n  * Add yy to contributors\n  * filen: swap to blake3 hashes\n  * docs: fix echo command syntax for password input\n  * docs: fix typos in comments and messages\n  * docs: fix use of removed rem macro\n  * uptobox: remove backend as service is no longer available\n  * rc: add operations/hashsumfile to sum a single file only\n  * docs: update sponsor link\n  * filen: add Filen backend - Fixes #6728\n  * sftp: fix proxy initialisation\n  * fstest: skip Copy mutation test with --sftp-copy-is-hardlink\n  * fstest: Make Copy mutation test work properly\n  * Add Qingwei Li to contributors\n  * Add Nicolas Dessart to contributors\n  * log: fix systemd adding extra newline - fixes #9086\n  * oracleobjectstorage, sftp: eliminate unnecessary heap allocation\n  * sftp,ftp: add http proxy authentication support\n  * Add Drime backend\n  * lib/rest: add opts.MultipartContentType to explicitly set Content-Type of attachements\n  * dircache: allow empty string as root parent id\n  * docs: update sponsors\n  * s3: add provider Bizfly Cloud Simple Storage\n  * docs: update sponsor logos\n  * Add sys6101 to contributors\n  * Add darkdragon-001 to contributors\n  * Add vupn0712 to contributors\n  * docs: add cloudinary to readme\n  * docs: fix headers hierarchy in mount docs\n  * s3: fix Copy ignoring storage class\n  * serve s3: make errors in --s3-auth-key fatal - fixes #9044\n  * Add masrlinu to contributors\n  * pcloud: add support for real-time updates in mount\n  * memory: add --memory-discard flag for speed testing - fixes #9037\n  * Add vyv03354 to contributors\n  * shade: Fix VFS test issues\n  * docs: mention use of ListR feature in ls docs\n  * build: bump actions/download-artifact from 6 to 7\n  * build: bump actions/upload-artifact from 5 to 6\n  * build: bump actions/cache from 4 to 5\n  * docs: reflects the fact that pCloud supports ListR\n  * S3: Linode: updated endpoints to use ISO 3166-1 alpha-2 standard\n  * sync: fix error propagation in tests (#9025)\n  * Changelog updates from Version v1.72.1\n  * s3: add more regions for Selectel\n  * Add jhasse-shade to contributors\n  * Add Shade backend\n  * log: fix backtrace not going to the --log-file #9014\n  * build: fix lint warning after linter upgrade\n  * Add Jonas Tingeborn to contributors\n  * Add Tingsong Xu to contributors\n  * configfile: add piped config support - fixes #9012\n  * fs/log: fix PID not included in JSON log output\n  * build: adjust lint rules to exclude new errors from linter update\n  * proxy: fix error handling in tests spotted by the linter\n  * Add Johannes Rothe to contributors\n  * Add Leo to contributors\n  * Add Vladislav Tropnikov to contributors\n  * Add Cliff Frey to contributors\n  * Add vicerace to contributors\n  * b2: Fix listing root buckets with unrestricted API key\n  * googlecloudstorage: improve endpoint parameter docs\n  * serve webdav: implement download-directory-as-zip\n  * s3: The ability to specify an IAM role for cross-account interaction\n  * azureblob: add metadata and tags support across upload and copy paths\n  * refactor: use strings.Cut to simplify code\n  * docs: note where a provider has an S3 compatible alternative\n  * Add Shade as sponsor\n  * Add Duncan Smart to contributors\n  * Add Diana to contributors\n  * docs: Clarify OAuth scopes for readonly Google Drive access\n  * b2: support authentication with new bucket restricted application keys\n  * docs: update sponsor logos\n  * docs: fix lint error in changelog\n  * Start v1.73.0-DEV development\n\n- Update to version 1.72.1:\n  * Version v1.72.1\n  * s3: add more regions for Selectel\n  * log: fix backtrace not going to the --log-file #9014\n  * build: fix lint warning after linter upgrade\n  * configfile: add piped config support - fixes #9012\n  * fs/log: fix PID not included in JSON log output\n  * build: adjust lint rules to exclude new errors from linter update\n  * proxy: fix error handling in tests spotted by the linter\n  * googlecloudstorage: improve endpoint parameter docs\n  * docs: note where a provider has an S3 compatible alternative\n  * Add Shade as sponsor\n  * docs: Clarify OAuth scopes for readonly Google Drive access\n  * docs: update sponsor logos\n  * docs: fix lint error in changelog\n  * Start v1.72.1-DEV development\n\n- Update to version 1.72.0:\n  * Version v1.72.0\n  * rc: fix formatting in job/batch\n  * test speed: fix formatting of help\n  * docs: update sponsor logos\n  * build: bump actions/checkout from 5 to 6\n  * s3: add multi-part-upload support for If-Match and If-None-Match\n  * rc: config/unlock: rename parameter to `configPassword` accept old as well\n  * rc: correct names of parameters in job/list output\n  * Add Nikolay Kiryanov to contributors\n  * rc: add `executeId` to job statuses - fixes #8972\n  * build: bump golang.org/x/crypto from 0.43.0 to 0.45.0 to fix CVE-2025-58181\n  * s3: fix single file copying behavior with low permission - Fixes #8975\n  * docs: onedrive: note how to backup up any user's data\n  * Add Dominik Sander to contributors\n  * Add jijamik to contributors\n  * box: allow to configure with config file contents\n  * http: add basic metadata and provide it via serve\n  * ftp: fix transfers from servers that return 250 ok messages\n  * b2: allow individual old versions to be deleted with --b2-versions - fixes #1626\n  * build: fix tls: failed to verify certificate: x509: negative serial number\n  * Add Sean Turner to contributors\n  * s3: add support for --upload-header If-Match and If-None-Match\n  * fix: comment typos\n  * dropbox: fix error moving just created objects - fixes #8881\n  * s3: add --s3-use-data-integrity-protections to fix  BadDigest error in Alibaba, Tencent\n  * rc: make sure fatal errors don't crash rclone - fixes #8955\n  * pacer: factor call stack searching into its own package\n  * rc: add osVersion, osKernel and osArch to core/version\n  * build: update all dependencies\n  * build(deps): bump golangci/golangci-lint-action from 8 to 9\n  * webdav: fix out of memory with sharepoint-ntlm when uploading large file\n  * testserver: fix owncloud test server startup\n  * Add aliaj1 to contributors\n  * ulozto: Fix downloads returning HTML error page\n  * docs: adjust spectra logic example endpoint name\n  * docs: update version introduced to v1.70 in doi docs\n  * testserver: fix HDFS server after run.bash adjustments\n  * testserver: remind developers about allocating a port\n  * testserver: make run.bash variables less likely to collide with scripts\n  * testserver: fix seafile servers messing up _connect string\n  * testserver: make sure TestWebdavInfiniteScale uses an assigned port\n  * testserver: make sure we don't overwrite the NAME variable set\n  * Add n4n5 to contributors\n  * Add Alex to contributors\n  * Add Copilot to contributors\n  * docs: update contributing docs regarding backend documentation\n  * rc: add jobs stats\n  * docs: fix alignment of some of the icons in the storage system dropdown\n  * docs: run markdownlint on _index.md\n  * docs: fix markdownlint issues and other styling improvements in backend command docs\n  * docs: fix markdownlint issue md046/code-block-style in backend command docs\n  * docs: fix missing punctuation in backend commands short description\n  * docs: fix markdownlint issues in backend command generated output\n  * build: improve backend docs autogenerated marker line\n  * backend/compress: add zstd compression\n  * sftp: fix zombie SSH processes with --sftp-ssh - Fixes #8929\n  * testserver: fix tests failing due to stopped servers\n  * docs: add new integration tester site link\n  * docs: update the method for running integration tests\n  * bisync: fix failing tests\n  * Add SublimePeace to contributors\n  * b2: fix \"expected a FileSseMode but found: ''\"\n  * docs: s3: clarify multipart uploads memory usage\n  * test_all: fix detection of running servers\n  * accounting: add AccountReadN for use in cluster\n  * fs: add NonDefaultRC for discovering options in use\n  * fs: move tests into correct files\n  * rc: add NewJobFromBytes for reading jobs from non HTTP transactions\n  * rc: add job/batch for sending batches of rc commands to run concurrently\n  * Add Ted Robertson to contributors\n  * Add Joseph Brownlee to contributors\n  * Add fries1234 to contributors\n  * Add Fawzib Rojas to contributors\n  * Add Riaz Arbi to contributors\n  * Add Lukas Krejci to contributors\n  * Add Adam Dinwoodie to contributors\n  * Add dulanting to contributors\n  * docs: add AppArmor restrictions to rclone mount\n  * check: improved reporting of differences in sizes and contents\n  * mega: implement 2FA login\n  * docs: change to light code block style to better match overall theme\n  * docs: fix various markdownlint issues\n  * build: restrict the markdown languages to use for code blocks\n  * docs: fix various markdownlint issues\n  * docs: fix markdownlint issue md013/line-length\n  * docs: change syntax hightlighting for command examples from sh to console\n  * docs: Clarify remote naming convention\n  * b2: Add Server-Side encryption support\n  * Added rclone archive command to create and read archive files\n  * accounting: add io.Seeker/io.ReaderAt support to accounting.Account\n  * operations: add ReadAt method to ReOpen\n  * fstest: add ResetRun to allow the remote to be reset in tests\n  * gcs: fix --gcs-storage-class to work with server side copy for objects\n  * ulozto: implement the about functionality\n  * local: add --skip-specials to ignore special files\n  * swift: Report disk usage in segment containers\n  * refactor: use strings.Builder to improve performance\n  * Archive backend to read archives on cloud storage.\n  * vfs: remove unecessary import in tests to fix import cycles\n  * Add Lakshmi-Surekha to contributors\n  * Add Andrew Gunnerson to contributors\n  * Add divinity76 to contributors\n  * build: enable support for aix/ppc64\n  * rc: fix name of \"queue\" JSON key in docs for vfs/cache\n  * cmount: windows: improve error message on missing winfsp\n  * docs: add the Provider to the options examples in the backend docs\n  * Add Aneesh Agrawal to contributors\n  * Add viocha to contributors\n  * Add reddaisyy to contributors\n  * fs: remove unnecessary Seek call on log file\n  * s3: make it easier to add new S3 providers\n  * build(deps): bump actions/upload-artifact from 4 to 5\n  * build(deps): bump actions/download-artifact from 5 to 6\n  * ftp: fix SOCK proxy support - fixes #8892 (#8918)\n  * webdav: Add Access-Control-Max-Age header for CORS preflight caching - fixes #5078\n  * webdav: use SpaceSepList to parse bearer token command\n  * refactor: use strings.Builder to improve performance\n  * docs: re-arrange sponsors page\n  * docs: add Spectra Logic as a sponsor\n  * Add Oleksandr Redko to contributors\n  * build: enable all govet checks (except fieldalignment and shadow) and fix issues.\n  * march: fix --no-traverse being very slow - fixes #8860\n  * Add vastonus to contributors\n  * s3: add new FileLu S5 endpoints\n  * build: remove obsolete build tag\n  * azurefiles: add ListP interface - #4788\n  * dropbox: add ListP interface - #4788\n  * webdav: add ListP interface - #4788\n  * pcloud: add ListP interface - #4788\n  * box: add ListP interface - #4788\n  * onedrive: add ListP interface - #4788\n  * drive: add ListP interface - #4788\n  * Add hunshcn to contributors\n  * webdav: optimize bearer token fetching with singleflight\n  * Changelog updates from Version v1.71.2\n  * lib/http: cleanup indentation and other whitespace in http serve template\n  * docs: improve formatting of http serve template parameters\n  * build: stop markdown linter leaving behind docker containers\n  * Add Marco Ferretti to contributors\n  * s3: add cubbit as provider\n  * s3: add servercore as a provider\n  * docs: update sponsors\n  * docs: update sponsor images\n  * docs: update privacy policy with a section on user data\n  * Add Dulani Woods to contributors\n  * Add spiffytech to contributors\n  * gcs: add region us-east5 - fixes #8863\n  * jottacloud: refactor service list from map to slice to get predefined order\n  * jottacloud: added support for traditional oauth authentication also for the main service\n  * oauthutil: improved debug logs from token refresh\n  * backend: add S3 provider for Hetzner object storage #8183\n  * jottacloud: improved token refresh handling\n  * s3: provider reordering\n  * index: add missing providers\n  * docs: add missing `\n  * s3: add rabata as a provider\n  * mega: fix 402 payment required errors - fixes #8758\n  * Add Andrew Ruthven to contributors\n  * Add Microscotch to contributors\n  * Add iTrooz to contributors\n  * build: Bump SwiftAIO container to a newer one\n  * build: Retry stopping the test server\n  * build: Increase attempts to connect to test server\n  * swift: If storage_policy isn't set, use the root containers policy\n  * proton: automated 2FA login with OTP secret key\n  * serve s3: fix log output to remove the EXTRA messages\n  * docs/jottacloud: update description of invalid_grant error according to changes\n  * jottacloud: add support for MediaMarkt Cloud as a whitelabel service\n  * s3: add FileLu S5 provider\n  * docs: fix variants of --user-from-header\n  * vfs: fix chunker integration test\n  * test_all: give TestZoho: extra time as it has been timing out\n  * test_all: give TestCompressDrive: extra time as it has been timing out\n  * rclone config string: reduce quoting with Human rendering for strings #8859\n  * Add juejinyuxitu to contributors\n  * docs/jottacloud: update documentation with new whitelabel services and changed configuration flow\n  * jottacloud: abort attempts to run unsupported rclone authorize command\n  * jottacloud: minor adjustment of texts in config ui\n  * jottacloud: add support for Let's Go Cloud (from MediaMarkt) as a whitelabel service\n  * jottacloud: fix authentication for whitelabel services from Elkj�p subsidiaries\n  * jottacloud: refactor config handling of whitelabel services to use openid provider configuration\n  * jottacloud: remove nil error object from error message\n  * jottacloud: fix legacy authentication\n  * docs: add remote setup page to main docs dropdown\n  * docs: update remote setup page\n  * docs: add link from authorize command docs to remote setup docs\n  * docs: lowercase internet and web browser instead of Internet browser\n  * docs: use the term backend name instead of fs name for authorize command\n  * add `rclone config string` for making connection strings #8859\n  * config: add more human readable configmap.Simple output\n  * serve http: download folders as zip\n  * s3: reorder providers to be in alphabetical order\n  * refactor: use strings.FieldsFuncSeq to reduce memory allocations\n  * accounting: add SetMaxCompletedTransfers method to fix bisync race #8815\n  * accounting: add RemoveDoneTransfers method to fix bisync race #8815\n  * bisync: fix race when CaptureOutput is used concurrently #8815\n  * build: update all dependencies\n  * Makefile: remove deprecated go mod usage\n  * azurefiles: Fix server side copy not waiting for completion -  fixes #8848\n  * Changelog updates from Version v1.71.1\n  * test_all: fix branch name in test report\n  * pacer: fix deadlock with --max-connections\n  * Revert \"azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\"\n  * Add Youfu Zhang to contributors\n  * Add Matt LaPaglia to contributors\n  * smb: optimize smb mount performance by avoiding stat checks during initialization\n  * pikpak: fix unnecessary retries by using URL expire parameter - fixes #8601\n  * serve http: fix: logging url on start\n  * docs: fix typo\n  * b2: fix 1TB+ uploads\n  * march: fix deadlock when using --fast-list on syncs - fixes #8811\n  * build: slices.Contains, added in go1.21\n  * build: use strings.CutPrefix introduced in go1.20\n  * build: use sequence Split introduced in go1.24\n  * build: use \"for i := range n\", added in go1.22\n  * build: modernize benchmark usage\n  * build: in tests use t.Context, added in go1.24\n  * build: replace interface{} by the 'any' type added in go1.18\n  * build: use the built-in min or max functions added in go1.21\n  * Add russcoss to contributors\n  * build: remove x := x made unnecessary by the new semantics of loops in go1.22\n  * lib/pool: fix unreliable TestPoolMaxBufferMemory test\n  * Update S-Pegg1 email\n  * Add Jean-Christophe Cura to contributors\n  * pool: fix flaky unreliability test\n  * copyurl: reworked code, added concurrency and tests\n  * copyurl: Added --url to read urls from csv file - #8127\n  * docs: HDFS: erasure coding limitation #8808\n  * fstest: fix slice bounds out of range error when using -remotes local\n  * local: fix time zones on tests\n  * s3: added SpectraLogic as a provider\n  * local: fix rmdir \"Access is denied\" on windows - fixes #8363\n  * bisync: fix error handling for renamed conflicts\n  * docs: pcloud: update root_folder_id instructions\n  * operations: fix partial name collisions for non --inplace copies\n  * drive: docs: update making your own client ID instructions\n  * swift: add ListP interface - #4788\n  * memory: add ListP interface - #4788\n  * oraceobjectstorage: add ListP interface - #4788\n  * B2: add ListP interface - #4788\n  * azureblob: add ListP interface - #4788\n  * googlecloudstorage: add ListP interface - Fixes #8763\n  * build: bump actions/github-script from 7 to 8\n  * build: bump actions/setup-go from 5 to 6\n  * bisync: fix chunker integration tests\n  * bisync: fix koofr integration tests\n  * internetarchive: fix server side copy files with spaces\n  * lib/rest: add URLPathEscapeAll to URL escape as many chars as possible\n  * Add alternate email for dougal to contributors\n  * test speed: add command to test a specified remotes speed\n  * docs: add link to MEGA S4 from MEGA page\n  * Add Robin Rolf to contributors\n  * Add anon-pradip to contributors\n  * s3: Add Intercolo provider\n  * gendocs: refactor and add logging of skipped command docs\n  * gendocs: ignore missing rclone_mount.md, rclone_nfsmount.md, rclone_serve_nfs.md on windows\n  * bin: add bisync.md generator\n  * fstest: refactor to decouple package from implementation\n  * gendocs: ignore missing rclone_mount.md on macOS\n  * bisync: ignore expected \"nothing to transfer\" differences on tests\n  * bisync: fix TestBisyncConcurrent ignoring -case\n  * bisync: make number of parallel tests configurable\n  * docs: clarify subcommand description in rclone usage\n  * docs: fix description of regex syntax of name transform\n  * docs: add some more details about supported regex syntax\n  * makefile: fix lib/transform docs not getting updated\n  * lib/pool: fix flaky test which was causing timeouts\n  * Add dougal to contributors\n  * vfs: fix SIGHUP killing serve instead of flushing directory caches\n  * bisync: use unique stats groups on tests\n  * fstest: stop errors in test cleanup changing the global stats\n  * Add Motte to contributors\n  * Add Claudius Ellsel to contributors\n  * build: add local markdown linting to make check\n  * lsf: add support for unix and unixnano time formats\n  * docs: remove broken links from rc to commands\n  * hashsum: changed output format when listing algorithms\n  * docs: add example of how to add date as suffix\n  * box: fix about after change in API return - fixes #8776\n  * Add skbeh to contributors\n  * Add Tilman Vogel to contributors\n  * docs: fix incorrectly escaped windows path separators\n  * build: restore error handling in gendocs\n  * combine: propagate SlowHash feature\n  * docs/oracleobjectstorage: add introduction before external links and remove broken link\n  * docs: fix markdown lint issues in backend docs\n  * docs: fix markdown lint issues in command docs\n  * docs: update markdown code block json indent size 2\n  * mount: do not log successful unmount as an error - fixes #8766\n  * Start v1.72.0-DEV development\n\n- Update to version 1.71.2:\n  * Version v1.71.2\n  * docs: update sponsors\n  * docs: update sponsor images\n  * docs: update privacy policy with a section on user data\n  * gcs: add region us-east5 - fixes #8863\n  * index: add missing providers\n  * docs: add missing `\n  * mega: fix 402 payment required errors - fixes #8758\n  * docs: fix variants of --user-from-header\n  * docs: add remote setup page to main docs dropdown\n  * docs: update remote setup page\n  * docs: add link from authorize command docs to remote setup docs\n  * docs: lowercase internet and web browser instead of Internet browser\n  * docs: use the term backend name instead of fs name for authorize command\n  * bisync: fix race when CaptureOutput is used concurrently #8815\n  * azurefiles: Fix server side copy not waiting for completion -  fixes #8848\n  * pikpak: fix unnecessary retries by using URL expire parameter - fixes #8601\n  * serve http: fix: logging url on start\n  * docs: fix typo\n  * b2: fix 1TB+ uploads\n  * Start v1.71.2-DEV development\n\n- Update to version 1.71.1:\n  * Version v1.71.1\n  * pacer: fix deadlock with --max-connections\n  * Revert \"azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\"\n  * march: fix deadlock when using --fast-list on syncs - fixes #8811\n  * docs: HDFS: erasure coding limitation #8808\n  * local: fix rmdir \"Access is denied\" on windows - fixes #8363\n  * bisync: fix error handling for renamed conflicts\n  * docs: pcloud: update root_folder_id instructions\n  * operations: fix partial name collisions for non --inplace copies\n  * drive: docs: update making your own client ID instructions\n  * internetarchive: fix server side copy files with spaces\n  * lib/rest: add URLPathEscapeAll to URL escape as many chars as possible\n  * docs: add link to MEGA S4 from MEGA page\n  * docs: clarify subcommand description in rclone usage\n  * docs: fix description of regex syntax of name transform\n  * docs: add some more details about supported regex syntax\n  * makefile: fix lib/transform docs not getting updated\n  * vfs: fix SIGHUP killing serve instead of flushing directory caches\n  * docs: remove broken links from rc to commands\n  * docs: add example of how to add date as suffix\n  * box: fix about after change in API return - fixes #8776\n  * docs: fix incorrectly escaped windows path separators\n  * build: restore error handling in gendocs\n  * combine: propagate SlowHash feature\n  * docs/oracleobjectstorage: add introduction before external links and remove broken link\n  * docs: fix markdown lint issues in backend docs\n  * docs: fix markdown lint issues in command docs\n  * docs: update markdown code block json indent size 2\n  * mount: do not log successful unmount as an error - fixes #8766\n  * Start v1.71.1-DEV development\n\n- Update to version 1.71.0:\n  * Version v1.71.0\n  * fs: tls: add --client-pass support for encrypted --client-key files\n  * ftp: make TLS config default to global TLS config - Fixes #6671\n  * fshttp: return *Transport rather than http.RoundTripper from NewTransport\n  * bisync: release from beta\n  * bisync: fix markdown formatting issues flagged by linter in docs\n  * bisync: fix --no-slow-hash settings on path2\n  * Add cui to contributors\n  * docs: add code of conduct\n  * lib/mmap: convert to using unsafe.Slice to avoid deprecated reflect.SliceHeader\n  * build: bump golangci/golangci-lint-action from 6 to 8\n  * build: update golangci-lint configuration\n  * build: ignore revive lint issue var-naming: avoid meaningless package names\n  * build: fix lint issue: should omit type error from declaration\n  * Revert \"build: downgrade linter to use go1.24 until it is fixed for go1.25\"\n  * build: migrate golangci-lint configuration to v2 format\n  * s3: add --s3-use-arn-region flag - fixes #8686\n  * Add Binbin Qian to contributors\n  * Add Lucas Bremgartner to contributors\n  * docs: add tips about outdated certificates\n  * FAQ: specify the availability of SSL_CERT_* env vars\n  * pikpak: add file name integrity check during upload\n  * bisync: skip TestBisyncConcurrent on non-local\n  * internetarchive: fix server side copy files with \u0026\n  * Revert \"s3: set useAlreadyExists to false for Alibaba OSS\"\n  * Add huangnauh to contributors\n  * smb: improve multithreaded upload performance using multiple connections\n  * bisync: fix data races on tests\n  * bisync: remove unused parameters\n  * bisync: deglobalize to fix concurrent runs via rc - fixes #8675\n  * mount: fix identification of symlinks in directory listings\n  * s3: fix Content-Type: aws-chunked causing upload errors with --metadata\n  * config: fix problem reading pasted tokens over 4095 bytes\n  * config: fix test failure on local machine with a config file\n  * log: add log rotation to --log-file - fixes #2259\n  * accounting: Fix stats (speed=0 and eta=nil) when starting jobs via rc\n  * docs: update overview table for oracle object storage\n  * Add praveen-solanki-oracle to contributors\n  * oracleobjectstorage: add read only metadata support - Fixes #8705\n  * doc: sync doesn't symlinks in dest without --link - Fixes #8749\n  * s3: sort providers in docs\n  * s3: add docs for Exaba Object Storage\n  * azureblob: fix double accounting for multipart uploads - fixes #8718\n  * pool: fix deadlock with --max-buffer-memory\n  * azureblob: fix deadlock with --max-connections with InvalidBlockOrBlob errors\n  * build: downgrade linter to use go1.24 until it is fixed for go1.25\n  * build: update all dependencies\n  * build: update to go1.25 and make go1.24 the minimum required version\n  * Add Timothy Jacobs to contributors\n  * bisync: fix time.Local data race on tests - fixes #8272\n  * googlecloudstorage: fix rateLimitExceeded error on bisync tests\n  * accounting: populate transfer snapshot with \"what\" value\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump actions/download-artifact from 4 to 5\n  * googlecloudstorage: enable bisync integration tests\n  * fstest: fix parsing of commas in -remotes\n  * azurefiles: fix hash getting erased when modtime is set\n  * bisync: disable --sftp-copy-is-hardlink on sftp tests\n  * local: fix --copy-links on Windows when listing Junction points\n  * operations: fix too many connections open when using --max-memory\n  * pool: fix deadlock with --max-memory and multipart transfers\n  * pool: unify memory between multipart and asyncreader to use one pool\n  * docs: update links to rcloneui\n  * docs: add MEGA S4 as a gold sponsor\n  * about: fix potential overflow of about in various backends\n  * box: fix about: cannot unmarshal number 1.0e+18 into Go struct field\n  * oauthutil: fix nil pointer crash when started with expired token\n  * rc: listremotes should send an empty array instead of nil\n  * config: add error if RCLONE_CONFIG_PASS was supplied but didn't decrypt config\n  * rc: add config/unlock to unlock the config file\n  * ftp: allow insecure TLS ciphers - fixes #8701\n  * s3: set useAlreadyExists to false for Alibaba OSS\n  * docs: update sponsors page\n  * fs: allow global variables to be overriden or set on backend creation\n  * fs: allow setting of --http_proxy from command line\n  * tests: cloudinary: remove test ignore after merging fix from #8707\n  * Add Antonin Goude to contributors\n  * Add Yu Xin to contributors\n  * Add houance to contributors\n  * Add Florent Vennetier to contributors\n  * Add n4n5 to contributors\n  * Add Albin Parou to contributors\n  * Add liubingrun to contributors\n  * sync: fix testLoggerVsLsf when backend only reads modtime\n  * sync: fix testLoggerVsLsf checking wrong fs\n  * docs: fix make opengraph tags absolute as not all sites understand relative\n  * docs: update contributing guide regarding markdown documentation\n  * build: add markdown linting to workflow\n  * build: add markdownlint configuration\n  * docs: minor format cleanup install.md\n  * docs: fix markdownlint issue md049/emphasis-style\n  * docs: fix markdownlint issue md036/no-emphasis-as-heading\n  * docs: fix markdownlint issue md033/no-inline-html\n  * docs: fix markdownlint issue md025/single-title\n  * docs: fix markdownlint issue md041/first-line-heading\n  * docs: fix markdownlint issue md001/heading-increment\n  * docs: fix markdownlint issue md003/heading-style\n  * docs: fix markdownlint issue md034/no-bare-urls\n  * docs: fix markdownlint issue md010/no-hard-tabs\n  * docs: fix markdownlint issue md013/line-length\n  * docs: fix markdownlint issue md038/no-space-in-code\n  * docs: fix markdownlint issue md040/fenced-code-language\n  * docs: fix markdownlint issue md046/code-block-style\n  * docs: fix markdownlint issue md037/no-space-in-emphasis\n  * docs: fix markdownlint issue md059/descriptive-link-text\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style\n  * docs: fix markdownlint issue md012/no-multiple-blanks\n  * docs: fix markdownlint issue md058/blanks-around-tables\n  * docs: fix markdownlint issue md022/blanks-around-headings\n  * docs: fix markdownlint issue md031/blanks-around-fences\n  * docs: fix markdownlint issue md032/blanks-around-lists\n  * docs: fix markdownlint issue md009/no-trailing-spaces\n  * docs: fix markdownlint issue md014/commands-show-output\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style (bin/update-authors.py)\n  * docs: fix markdownlint issues md007/ul-indent md004/ul-style (authors.md)\n  * docs: add opengraph tags for website social media previews\n  * mount: note that bucket based remotes can use directory markers\n  * pikpak: add docs for methods to clarify name collision handling and restrictions\n  * pikpak: enhance Copy method to handle name collisions and improve error management\n  * pikpak: enhance Move for better handling of error and name collision\n  * accounting: fix incorrect stats with --transfers=1 - fixes #8670\n  * rc: fix `operations/check` ignoring `oneWay` parameter\n  * s3: add OVHcloud Object Storage provider\n  * docs: rc: fix description of how to read local config\n  * build: limit check for edits of autogenerated files to only commits in a pull request\n  * build: extend check for edits of autogenerated files to all commits in a pull request\n  * smb: refresh Kerberos credentials when ccache file changes\n  * s3: fix multipart upload and server side copy when using bucket policy SSE-C\n  * backend/s3: Fix memory leak by cloning strings #8683\n  * purge: exit with a fatal error if filters are set on `rclone purge`\n  * docs: Add Backblaze as a Platinum sponsor\n  * Add Sam Pegg to contributors\n  * googlephotos: added warning for Google Photos compatability-fixes #8672\n  * test: remove flakey TestChunkerChunk50bYandex: test\n  * docs: Consolidate entries for Josh Soref in contributors\n  * docs: remove dead link to example of writing a plugin\n  * filescom: document that hashes need to be enabled - fixes #8674\n  * Add Sudipto Baral to contributors\n  * docs: fix incorrect json syntax in sample output\n  * docs: ignore author email piyushgarg80\n  * docs: fix header level for --dump option section\n  * docs: use stringArray as parameter type\n  * docs: use consistent markdown heading syntax\n  * imagekit: remove server side Copy method as it was downloading and uploading\n  * imagekit: don't low level retry uploads\n  * imagekit: return correct error when attempting to upload zero length files\n  * smb: add --smb-kerberos-ccache option to set kerberos ccache per smb backend\n  * test: fix smb kerberos integration tests\n  * Changelog updates from Version v1.70.3\n  * config: make parsing of duration options consistent\n  * docs: cleanup usage\n  * docs: break long lines\n  * docs: add option value type to header where missing\n  * docs: mention that identifiers in option values are case insensitive\n  * docs: rewrite dump option examples\n  * docs: use markdown inline code format for dump option headers that are real examples\n  * docs: change spelling from server side to server-side\n  * docs: cleanup header casing\n  * docs: rename OSX to macOS\n  * docs: fix list and code block issue\n  * docs: consistent markdown list format\n  * docs: split section with general description of options with that documenting actual main options\n  * docs: improve description of option types\n  * docs: use space instead of equal sign to separate option and value in headers\n  * docs: use comma to separate short and long option format in headers\n  * docs: remove use of uncommon parameter types\n  * docs: remove use of parameter type FILE\n  * docs: remove use of parameter type DIR\n  * docs: remove use of parameter type CONFIG_FILE\n  * docs: change use of parameter type N and NUMBER to int consistent with flags and cli help\n  * docs: change use of parameter type TIME to Duration consistent with flags and cli help\n  * docs: change use of parameter type BANDWIDTH_SPEC to BwTimetable consistent with flags and cli help\n  * docs: change use of parameter type SIZE to SizeSuffix consistent with flags and cli help\n  * docs: cleanup markdown header format\n  * docs: explain separated list parameters\n  * azureblob: fix server side copy error \"requires exactly one scope\"\n  * test: remove and ignore failing integration tests\n  * docs: explain the json log format in more detail\n  * check: fix difference report (was reporting error counts)\n  * serve sftp: add support for more hashes (crc32, sha256, blake3, xxh3, xxh128)\n  * serve sftp: extract function refactoring for handling hashsum commands\n  * sftp: add support for more hashes (crc32, sha256, blake3, xxh3, xxh128)\n  * local: configurable supported hashes\n  * hash: add support for BLAKE3, XXH3, XXH128\n  * vfs: make integration TestDirEntryModTimeInvalidation test more reliable\n  * smb: skip non integration tests when doing integration tests\n  * seafile: fix integration test errors by adding dot to encoding\n  * linkbox: fix upload error \"user upload file not exist\"\n  * build: remove integration tests which are too slow\n  * march: fix deadlock when using --no-traverse - fixes #8656\n  * pikpak: improve error handling for missing links and unrecoverable 500s\n  * pikpak: rewrite upload to bypass AWS S3 manager - fixes #8629\n  * test: fix TestSMBKerberos password expiring errors\n  * Add Vikas Bhansali to contributors\n  * Add Ross Smith II to contributors\n  * azureblob,azurefiles: add support for client assertion based authentication\n  * webdav: fix setting modtime to that of local object instead of remote\n  * build: set default shell to bash in build.yml\n  * docs: fix filescom/filelu link mixup\n  * Add Davide Bizzarri to contributors\n  * fix: b2 versionAt read metadata\n  * test: make TestWebdavInfiniteScale startup more reliable\n  * test_all: add _connect_delay for slow starting servers\n  * docs: update link for filescom\n  * test_all: make TestWebdav InfiniteScale integration tests run\n  * test_all: make SMB with Kerberos integration tests run properly\n  * test_all: allow an env parameter to set environment variables\n  * Changelog updates from Version v1.70.2\n  * Add Ali Zein Yousuf to contributors\n  * Add $@M@RTH_ to contributors\n  * docs: update client ID instructions to current Azure AD portal - fixes #8027\n  * s3: add Zata provider\n  * pacer: fix nil pointer deref in RetryError - fixes #8077\n  * docs: Remove Warp as a sponsor\n  * docs: add files.com as a Gold sponsor\n  * docs: add links to SecureBuild docker image\n  * Add curlwget to contributors\n  * convmv: fix moving to unicode-equivalent name - fixes #8634\n  * transform: add truncate_keep_extension and truncate_bytes\n  * convmv: make --dry-run logs less noisy\n  * sync: avoid copying dir metadata to itself\n  * docs: fix some function names in comments\n  * combine: fix directory not found errors with ListP interface - Fixes #8627\n  * local: fix --skip-links on Windows when skipping Junction points\n  * Add Marvin R�sch to contributors\n  * build: bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 to fix GHSA-vrw8-fxc6-2r93\n  * copy,copyto,move,moveto: implement logger flags to store result of sync\n  * log: fix deadlock when using systemd logging - fixes #8621\n  * docs: googlephotos: detail how to make your own client_id - fixes #8622\n  * Add necaran to contributors\n  * mega: fix tls handshake failure - fixes #8565\n  * Changelog updates from Version v1.70.1\n  * Add jinjingroad to contributors\n  * docs: DOI grammar error\n  * docs: lib/transform: cleanup formatting\n  * lib/transform: avoid empty charmap entry\n  * chore: fix function name\n  * convmv: fix spurious \"error running command echo\" on Windows\n  * docs: client-credentials is not support by all backends\n  * Start v1.71.0-DEV development\n\n- Update to version 1.70.3:\n  * Version v1.70.3\n  * azureblob: fix server side copy error \"requires exactly one scope\"\n  * docs: explain the json log format in more detail\n  * check: fix difference report (was reporting error counts)\n  * linkbox: fix upload error \"user upload file not exist\"\n  * march: fix deadlock when using --no-traverse - fixes #8656\n  * pikpak: improve error handling for missing links and unrecoverable 500s\n  * webdav: fix setting modtime to that of local object instead of remote\n  * fix: b2 versionAt read metadata\n  * Start v1.70.3-DEV development\n  * docs: fix filescom/filelu link mixup\n  * docs: update link for filescom\n\n- Update to version 1.70.2:\n  * Version v1.70.2\n  * docs: update client ID instructions to current Azure AD portal - fixes #8027\n  * mega: fix tls handshake failure - fixes #8565\n  * pacer: fix nil pointer deref in RetryError - fixes #8077\n  * convmv: fix moving to unicode-equivalent name - fixes #8634\n  * convmv: make --dry-run logs less noisy\n  * sync: avoid copying dir metadata to itself\n  * combine: fix directory not found errors with ListP interface - Fixes #8627\n  * local: fix --skip-links on Windows when skipping Junction points\n  * build: bump github.com/go-chi/chi/v5 from 5.2.1 to 5.2.2 to fix GHSA-vrw8-fxc6-2r93\n  * log: fix deadlock when using systemd logging - fixes #8621\n  * docs: googlephotos: detail how to make your own client_id - fixes #8622\n  * pikpak: fix uploads fail with \"aws-chunked encoding is not supported\" error\n  * Start v1.70.2-DEV development\n  * docs: Remove Warp as a sponsor\n  * docs: add files.com as a Gold sponsor\n  * docs: add links to SecureBuild docker image\n\n- Update to version 1.70.1:\n  * Version v1.70.1\n  * docs: DOI grammar error\n  * docs: lib/transform: cleanup formatting\n  * lib/transform: avoid empty charmap entry\n  * chore: fix function name\n  * convmv: fix spurious \"error running command echo\" on Windows\n  * docs: client-credentials is not support by all backends\n  * Start v1.70.1-DEV development\n\n- Update to version 1.70.0:\n  * Version v1.70.0\n  * ftp: add --ftp-http-proxy to connect via HTTP CONNECT proxy\n  * pcloud: fix \"Access denied. You do not have permissions to perform this operation\" on large uploads\n  * operations: fix TransformFile when can't server-side copy/move\n  * fstest: fix -verbose flag after logging revamp\n  * googlecloudstorage: fix directory marker after // changes in #5858\n  * s3: fix directory marker after // changes in #5858\n  * azureblob: fix directory marker after // changes in #5858\n  * tests: ignore some more habitually failing tests\n  * googlephotos: fix typo in error message - Fixes #8600\n  * s3: MEGA S4 support\n  * Add Ser-Bul to contributors\n  * chunker: fix double-transform\n  * docs: mailru: added note about permissions level choice for the  apps password\n  * tests: ignore habitually failing tests and backends\n  * docs: link to asciinema rather than including the js\n  * docs: target=\"_blank\" must have rel=\"noopener\"\n  * sync: fix testLoggerVsLsf when dst is local\n  * docs: fix FileLu docs\n  * build: update all dependencies\n  * onedrive: fix crash if no metadata was updated\n  * Add kingston125 to contributors\n  * Add Flora Thiebaut to contributors\n  * Add FileLu cloud storage backend\n  * doi: add new doi backend\n  * build: fix check_autogenerated_edits.py flagging up files that didn't exist\n  * docs: rc: add more info on how to discover _config and _filter parameters #8584\n  * s3: add Exaba provider\n  * convmv: add convmv command\n  * lib/transform: add transform library and --name-transform flag\n  * march: split src and dst\n  * Add ahxxm to contributors\n  * Add Nathanael Demacon to contributors\n  * b2: use file id from listing when not presented in headers - fixes #8113\n  * fs: fix goroutine leak and improve stats accounting process\n  * march: fix syncing with a duplicate file and directory\n  * Add PrathameshLakawade to contributors\n  * Add Oleksiy Stashok to contributors\n  * docs: fix page_facing_up typo next to Lyve Cloud in README.md\n  * backend/s3: require custom endpoint for Lyve Cloud v2 support\n  * backend: skip hash calculation when the hashType is None - fixes #8518\n  * azureblob: fix multipart server side copies of 0 sized files\n  * Add Jeremy Daer to contributors\n  * Add wbulot to contributors\n  * s3: add Pure Storage FlashBlade provider support (#8575)\n  * backend/gofile: update to use new direct upload endpoint\n  * log: add --windows-event-log-level to support Windows Event Log\n  * fs: Remove github.com/sirupsen/logrus and replace with log/slog\n  * Add fhuber to contributors\n  * cmd serve s3: fix ListObjectsV2 response\n  * Changelog updates from Version v1.69.3\n  * onedrive: re-add --onedrive-upload-cutoff flag\n  * onedrive: fix \"The upload session was not found\" errors\n  * Add Germ�n Casares to contributors\n  * Add Jeff Geerling to contributors\n  * googlephotos: update read only and read write scopes to meet Google's requirements.\n  * build: update github.com/ebitengine/purego to v0.8.3 to fix mac_amd64 build\n  * docs: add hint about config touch and config file not found\n  * docs: add FAQ for dismissing 'rclone.conf not found'\n  * docs: document how to keep an out of tree backend\n  * Add Cl�ment Wehrung to contributors\n  * iclouddrive: fix panic and files potentially downloaded twice\n  * docs: move --max-connections documentation to the correct place\n  * Add Ben Boeckel to contributors\n  * Add Tho Neyugn to contributors\n  * docs: fix typo in s3/storj docs\n  * serve s3: remove redundant handler initialization\n  * Changelog updates from Version 1.69.2\n  * sftp: add --sftp-http-proxy to connect via HTTP CONNECT proxy\n  * Add Jugal Kishore to contributors\n  * docs: correct SSL docs anchor link from #ssl-tls to #tls-ssl\n  * drive: metadata: fix error when setting copy-requires-writer-permission on a folder\n  * docs: Update contributors\n  * build: bump golang.org/x/net from 0.36.0 to 0.38.0\n  * Update README.md\n  * docs: fix typos via codespell\n  * webdav: add an ownCloud Infinite Scale vendor that enables tus chunked upload support\n  * onedrive: fix metadata ordering in permissions\n  * Add Ben Alex to contributors\n  * Add simwai to contributors\n  * iclouddrive: fix so created files are writable\n  * cmd/authorize: show required arguments in help text\n  * cloudinary: var naming convention - #8416\n  * cloudinary: automatically add/remove known media files extensions #8416\n  * Add Markus Gerstel to contributors\n  * Add Enduriel to contributors\n  * Add huanghaojun to contributors\n  * Add simonmcnair to contributors\n  * Add Samantha Bowen to contributors\n  * s3: documentation regression - fixes #8438\n  * hash: add SHA512 support for file hashes\n  * vfs: fix inefficient directory caching when directory reads are slow\n  * docs: update fuse version in docker docs\n  * fs/config: Read configuration passwords from stdin even when terminated with EOF - fixes #8480\n  * cmd/gitannex: Reject unknown layout modes in INITREMOTE\n  * cmd/gitannex: Add configparse.go and refactor\n  * cmd/gitannex: Permit remotes with options\n  * serve ftp: add serve rc interface\n  * serve sftp: add serve rc interface\n  * serve restic: add serve rc interface\n  * serve s3: add serve rc interface\n  * serve dlna: add serve rc interface\n  * serve webdav: add serve rc interface - fixes #4505\n  * serve http: add serve rc interface\n  * serve nfs: add serve rc interface\n  * serve: Add rc control for serve commands #4505\n  * configstruct: add SetAny to parse config from the rc\n  * rc: In options/info make FieldName contain a \".\" if it should be nested\n  * serve restic: convert options to new style\n  * serve s3: convert options to new style\n  * serve http: convert options to new style\n  * serve webdav: convert options to new style\n  * auth proxy: convert options to new style\n  * auth proxy: add VFS options parameter for use for default VFS\n  * serve: make the servers self registering\n  * lib/http: fix race between Serve() and Shutdown()\n  * lib/http: add Addr() method to return the first configured server address\n  * Add Danny Garside to contributors\n  * docs: fix minor typo in box docs\n  * sync: implement --list-cutoff to allow on disk sorting for reduced memory use\n  * march: Implement callback based syncing\n  * list: add ListDirSortedFn for callback oriented directory listing\n  * list: Implement Sorter to sort directory entries\n  * cache: mark ListP as not supported yet\n  * hasher: implement ListP interface\n  * compress: implement ListP interface\n  * chunker: mark ListP as not supported yet\n  * union: mark ListP as not supported yet\n  * crypt: implement ListP interface\n  * combine: implement ListP interface\n  * s3: Implement paged listing interface ListP\n  * list: add WithListP helper to implement List for ListP backends\n  * walk: move NewListRHelper into list.Helper to avoid circular dependency\n  * fs: define ListP interface for paged listing #4788\n  * accounting: Add listed stat for number of directory entries listed\n  * walk: factor Listing helpers into their own file and add tests\n  * serve nfs: make metadata files have special file handles\n  * serve nfs: change the format of --nfs-cache-type symlink file handles\n  * vfs: add --vfs-metadata-extension to expose metadata sidecar files\n  * docs: Add rcloneui.com as Silver Sponsor\n  * Add Klaas Freitag to contributors\n  * Add eccoisle to contributors\n  * Add Fernando Fern�ndez to contributors\n  * Add alingse to contributors\n  * Add J�rn Friedrich Dreyer to contributors\n  * docs: replace option --auto-filename-header with --header-filename\n  * build: update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to fix CVE-2025-30204\n  * docs/googlephotos: fix typos\n  * build: bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2\n  * operations: fix call fmt.Errorf with wrong err\n  * webdav: retry propfind on 425 status\n  * Add --max-connections to control maximum backend concurrency\n  * rc: fix debug/* commands not being available over unix sockets\n  * cmd/gitannex: Prevent tests from hanging when assertion fails\n  * cmd/gitannex: Add explicit timeout for mock stdout reads in tests\n  * http: correct root if definitely pointing to a file - fixes #8428\n  * pool: add --max-buffer-memory to limit total buffer memory usage\n  * filter: Add `--hash-filter` to deterministically select a subset of files\n  * build: update golang.org/x/net to 0.36.0. to fix CVE-2025-22869\n  * rc: add add short parameter to core/stats to not return transferring and checking\n  * fs: fix corruption of SizeSuffix with \"B\" suffix in config (eg --min-size)\n  * filters: show --min-size and --max-size in --dump filters\n  * build: check docs for edits of autogenerated sections\n  * Add jack to contributors\n  * docs: fix incorrect mentions of vfs-cache-min-free-size\n  * fs/object: fix memory object out of bounds Seek\n  * serve nfs: fix unlikely crash\n  * docs: update minimum OS requirements for go1.24\n  * cmd/gitannex: Tweak parsing of \"rcloneremotename\" config\n  * cmd/gitannex: Drop var rebindings now that we have go1.23\n  * docs: add note for using rclone cat for slicing out a byte range from a file\n  * rcserver: improve content-type check\n  * build: modernize Go usage\n  * build: update all dependencies and fix deprecations\n  * build: update golang.org/x/crypto to v0.35.0 to fix CVE-2025-22869\n  * build: make go1.23 the minimum go version\n  * cmd/gitannex: Add to integration tests\n  * cmd/gitannex: Simplify verbose failures in tests\n  * cmd/gitannex: Port unit tests to fstest\n  * vfs: fix integration test failures\n  * azureblob: fix errors not being retried when doing single part copy\n  * azureblob: handle retry error codes more carefully\n  * touch: make touch obey --transfers\n  * Add luzpaz to contributors\n  * Add Dave Vasilevsky to contributors\n  * docs: fix various typos Found via\n  * dropbox: Retry link without expiry\n  * Dropbox: Support Dropbox Paper\n  * chore: update contributor email\n  * docs: correct stable release workflow\n  * Add Lorenz Brun to contributors\n  * Add Michael Kebe to contributors\n  * vfs: fix directory cache serving stale data\n  * build: fix docker plugin build - fixes #8394\n  * docs: improved sftp limitations\n  * Changelog updates from Version v1.69.1\n  * docs: add FileLu as sponsors and tidy sponsor logos\n  * accounting: fix percentDiff calculation -- fixes #8345\n  * vfs: fix the cache failing to upload symlinks when --links was specified\n  * Add jbagwell-akamai to contributors\n  * Add ll3006 to contributors\n  * doc: add note on concurrency of rclone purge\n  * s3: add latest Linode Object Storage endpoints\n  * cmd: fix crash if rclone is invoked without any arguments - Fixes #8378\n  * build: disable docker builds on PRs \u0026 add missing dockerfile changes\n  * sync: copy dir modtimes even when copyEmptySrcDirs is false - fixes #8317\n  * sync: add tests to check dir modtimes are kept when syncing\n  * fix golangci-lint errors\n  * bisync: fix false positive on integration tests\n  * s3: split the GCS quirks into -s3-use-x-id and -s3-sign-accept-encoding #8373\n  * Add Joel K Biju to contributors\n  * stats: fix the speed not getting updated after a pause in the processing\n  * opendrive: added --opendrive-access flag to handle permissions\n  * bisync: fix listings missing concurrent modifications - fixes #8359\n  * Added parallel docker builds and caching for go build in the container\n  * smb: improve connection pooling efficiency\n  * lib/oauthutil: fix redirect URL mismatch errors - fixes #8351\n  * b2: fix \"fatal error: concurrent map writes\" - fixes #8355\n  * Add Alexander Minbaev to contributors\n  * Add Zachary Vorhies to contributors\n  * Add Jess to contributors\n  * s3: add IBM IAM signer - fixes #7617\n  * serve nfs: update docs to note Windows is not supported - fixes #8352\n  * cmd/config(update remote): introduce --no-output option\n  * s3: add DigitalOcean regions SFO2, LON1, TOR1, BLR1\n  * sync: fix cpu spinning when empty directory finding with leading slashes\n  * s3: fix handling of objects with // in #5858\n  * azureblob: fix handling of objects with // in #5858\n  * fstest: add integration tests objects with // on bucket based backends #5858\n  * fs/list: tweak directory listing assertions after allowing // names\n  * lib/bucket: fix tidying of // in object keys #5858\n  * lib/bucket: add IsAllSlashes function\n  * azureblob: remove uncommitted blocks on InvalidBlobOrBlock error\n  * azureblob: implement multipart server side copy\n  * azureblob: speed up server side copies for small files #8249\n  * azureblob: cleanup uncommitted blocks on upload errors\n  * azureblob: factor readMetaData into readMetaDataAlways returning blob properties\n  * Add b-wimmer to contributors\n  * azurefiles: add --azurefiles-use-az and --azurefiles-disable-instance-discovery\n  * onedrive: mark German (de) region as deprecated\n  * Add Trevor Starick to contributors\n  * Add hiddenmarten to contributors\n  * Add Corentin Barreau to contributors\n  * Add Bruno Fernandes to contributors\n  * Add Moises Lima to contributors\n  * Add izouxv to contributors\n  * Add Robin Schneider to contributors\n  * Add Tim White to contributors\n  * Add Christoph Berger to contributors\n  * azureblob: add support for `x-ms-tags` header\n  * rc: disable the metrics server when running `rclone rc`\n  * internetarchive: add --internetarchive-metadata=\"key=value\" for setting item metadata\n  * lib/batcher: Deprecate unused option: batch_commit_timeout\n  * s3: Added new storage class to magalu provider\n  * http servers: add --user-from-header to use for authentication\n  * b2: add SkipDestructive handling to backend commands - fixes #8194\n  * vfs: close the change notify channel on Shutdown\n  * Docker image: Add label org.opencontainers.image.source for release notes in Renovate dependency updates\n  * docs: add OneDrive Impersonate instructions - fixes #5610\n  * docs: explain the stringArray flag parameter descriptor\n  * iclouddrive: add notes on ADP and Missing PCS cookies - fixes #8310\n  * docs: fix typos found by codespell in docs and code comments\n  * fs: fix confusing \"didn't find section in config file\" error\n  * vfs: fix race detected by race detector\n  * Add Jonathan Giannuzzi to contributors\n  * Add Spencer McCullough to contributors\n  * Add Matt Ickstadt to contributors\n  * smb: add support for kerberos authentication\n  * drive: added `backend moveid` command\n  * docs: fix reference to serves3 setting disable_multipart_uploads which was renamed\n  * docs: fix link to Rclone Serve S3\n  * serve s3: fix list objects encoding-type\n  * build: update gopkg.in/yaml.v2 to v3\n  * build: update all dependencies\n  * bisync: fix go vet problems with go1.24\n  * build: update to go1.24rc1 and make go1.22 the minimum required version\n  * version: add --deps flag to show dependencies and other build info\n  * doc: make man page well formed for whatis - fixes #7430\n  * Start v1.70.0-DEV development\n\n- Install completion files in the right place.\n\n- Update to version 1.69.3:\n  * build: update github.com/ebitengine/purego to work around bug in go1.24.3\n  * build: reapply update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to fix CVE-2025-30204\n\n- Update to version 1.69.2:\n  - Bug fixes\n    - accounting: Fix percentDiff calculation -- (Anagh Kumar\n      Baranwal)\n    - build\n      - Update github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 to\n        fix CVE-2025-30204 (dependabot[bot])\n      - Update github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 to\n        fix CVE-2025-30204 (dependabot[bot])\n      - Update golang.org/x/crypto to v0.35.0 to fix CVE-2025-22869\n        (Nick Craig-Wood)\n      - Update golang.org/x/net from 0.36.0 to 0.38.0 to fix\n        CVE-2025-22870 (dependabot[bot])\n      - Update golang.org/x/net to 0.36.0. to fix CVE-2025-22869\n        (dependabot[bot])\n      - Stop building with go \u003c go1.23 as security updates forbade\n        it (Nick Craig-Wood)\n      - Fix docker plugin build (Anagh Kumar Baranwal)\n    - cmd: Fix crash if rclone is invoked without any arguments\n      (Janne Hellsten)\n    - config: Read configuration passwords from stdin even when\n      terminated with EOF (Samantha Bowen)\n    - doc fixes (Andrew Kreimer, Danny Garside, eccoisle, Ed\n      Craig-Wood, emyarod, jack, Jugal Kishore, Markus Gerstel,\n      Michael Kebe, Nick Craig-Wood, simonmcnair, simwai, Zachary\n      Vorhies)\n    - fs: Fix corruption of SizeSuffix with \"B\" suffix in config\n      (eg --min-size) (Nick Craig-Wood)\n    - lib/http: Fix race between Serve() and Shutdown() (Nick\n      Craig-Wood)\n    - object: Fix memory object out of bounds Seek (Nick\n      Craig-Wood)\n    - operations: Fix call fmt.Errorf with wrong err (alingse)\n    - rc\n      - Disable the metrics server when running rclone rc\n        (hiddenmarten)\n      - Fix debug/* commands not being available over unix sockets\n        (Nick Craig-Wood)\n    - serve nfs: Fix unlikely crash (Nick Craig-Wood)\n    - stats: Fix the speed not getting updated after a pause in the\n      processing (Anagh Kumar Baranwal)\n    - sync\n      - Fix cpu spinning when empty directory finding with leading\n        slashes (Nick Craig-Wood)\n      - Copy dir modtimes even when copyEmptySrcDirs is false\n        (ll3006)\n  - vfs\n    - Fix directory cache serving stale data (Lorenz Brun)\n    - Fix inefficient directory caching when directory reads are\n      slow (huanghaojun)\n    - Fix integration test failures (Nick Craig-Wood)\n  - Drive\n    - Metadata: fix error when setting\n      copy-requires-writer-permission on a folder (Nick Craig-Wood)\n  - Dropbox\n    - Retry link without expiry (Dave Vasilevsky)\n  - HTTP\n    - Correct root if definitely pointing to a file (nielash)\n  - Iclouddrive\n    - Fix so created files are writable (Ben Alex)\n  - Onedrive\n    - Fix metadata ordering in permissions (Nick Craig-Wood)\n\n- Update to version 1.69.1:\n  * Version v1.69.1\n  * build: disable docker builds on PRs \u0026 add missing dockerfile changes\n  * Added parallel docker builds and caching for go build in the container\n  * docs: add FileLu as sponsors and tidy sponsor logos\n  * vfs: fix the cache failing to upload symlinks when --links was specified\n  * doc: add note on concurrency of rclone purge\n  * s3: add latest Linode Object Storage endpoints\n  * fix golangci-lint errors\n  * bisync: fix listings missing concurrent modifications - fixes #8359\n  * lib/oauthutil: fix redirect URL mismatch errors - fixes #8351\n  * b2: fix \"fatal error: concurrent map writes\" - fixes #8355\n  * serve nfs: update docs to note Windows is not supported - fixes #8352\n  * s3: add DigitalOcean regions SFO2, LON1, TOR1, BLR1\n  * onedrive: mark German (de) region as deprecated\n  * s3: Added new storage class to magalu provider\n  * vfs: close the change notify channel on Shutdown\n  * docs: add OneDrive Impersonate instructions - fixes #5610\n  * docs: explain the stringArray flag parameter descriptor\n  * iclouddrive: add notes on ADP and Missing PCS cookies - fixes #8310\n  * docs: fix typos found by codespell in docs and code comments\n  * fs: fix confusing \"didn't find section in config file\" error\n  * vfs: fix race detected by race detector\n  * docs: fix reference to serves3 setting disable_multipart_uploads which was renamed\n  * docs: fix link to Rclone Serve S3\n  * serve s3: fix list objects encoding-type\n  * doc: make man page well formed for whatis - fixes #7430\n  * Start v1.69.1-DEV development\n\n- Update to version 1.69.0:\n  https://rclone.org/changelog/#v1-69-0-2025-01-12\n\n  Rclone is using golang.org/x/net but was not affected to\n  CVE-2024-45337 and CVE-2024-45338.\n\n  * Version v1.69.0\n  * test_all: disable docker plugin tests\n  * docs: fix typo\n  * accounting: fix race stopping/starting the stats counter\n  * docs: add github.com/icholy/gomajor to RELEASE for updating major versions\n  * ftp: fix ls commands returning empty on \"Microsoft FTP Service\" servers\n  * s3: add docs on data integrity\n  * webdav: make --webdav-auth-redirect to fix 401 unauthorized on redirect\n  * rest: make auth preserving redirects an option\n  * box: fix panic when decoding corrupted PEM from JWT file\n  * size: make output compatible with -P\n  * vfs: add remote name to vfs cache log messages - fixes #7952\n  * dropbox: fix return status when full to be fatal error\n  * rc: add relative to vfs/queue-set-expiry\n  * vfs: fix open files disappearing from directory listings\n  * docker serve: parse all remaining mount and VFS options\n  * smb: fix panic if stat fails\n  * googlephotos: fix nil pointer crash on upload - fixes #8233\n  * iclouddrive: tweak docs\n  * serve dlna: sort the directory entries by directories first then alphabetically by name\n  * serve nfs: fix missing inode numbers which was messing up ls -laR\n  * serve nfs: implement --nfs-cache-type symlink\n  * azureblob,oracleobjectstorage,s3: quit multipart uploads if the context is cancelled\n  * http: fix incorrect URLs with initial slash\n  * build: update `github.com/shirou/gopsutil` to v4\n  * Replace Windows-specific NewLazyDLL with NewLazySystemDLL\n  * lib/oauthutil: don't require token to exist for client credentials flow\n  * fs/operations: make log messages consistent for mkdir/rmdir at INFO level\n  * Add Francesco Frassinelli to contributors\n  * smb: Add support for Kerberos authentication.\n  * docs: smb: link to CloudSoda/go-smb2 fork\n  * cloudinary: add cloudinary backend - fixes #7989\n  * operations: fix eventual consistency in TestParseSumFile test\n  * Add TAKEI Yuya to contributors\n  * docs: Remove Backblaze as a Platinum sponsor\n  * docs: add RcloneView as silver sponsor\n  * serve docker: fix incorrect GID assignment\n  * serve s3: fix Last-Modified timestamp\n  * Add ToM to contributors\n  * Add Henry Lee to contributors\n  * Add Louis Laureys to contributors\n  * docs: filtering: mention feeding --files-from from standard input\n  * docs: filtering: fix --include-from copypaste error\n  * s3: rename glacier storage class to flexible retrieval\n  * b2: add daysFromStartingToCancelingUnfinishedLargeFiles to backend lifecycle command\n  * build: update golang.org/x/net to v0.33.0 to fix CVE-2024-45338\n  * azurefiles: fix missing x-ms-file-request-intent header\n  * Add Thomas ten Cate to contributors\n  * docs: Document --url and --unix-socket on the rc page\n  * docs: link to the outstanding vfs symlinks issue\n  * Add Yxxx to contributors\n  * Add hayden.pan to contributors\n  * docs: update pcloud doc to avoid puzzling token error when use remote rclone authorize\n  * pikpak: add option to use original file links - fixes #8246\n  * rc/job: use mutex for adding listeners thread safety\n  * docs: mention in serve tls options when value is path to file - fixes #8232\n  * build: update all dependencies\n  * accounting: fix debug printing when debug wasn't set\n  * Add Filipe Azevedo to contributors\n  * fs: make --links flag global and add new --local-links and --vfs-links flag\n  * vfs: add docs for -l/--links flag\n  * nfsmount,serve nfs: introduce symlink support #2975\n  * mount2: introduce symlink support #2975\n  * mount: introduce symlink support #2975\n  * cmount: introduce symlink support #2975\n  * vfstest: make VFS test suite support symlinks\n  * vfs: add symlink support to VFS\n  * vfs: add ELOOP error\n  * vfs: Add link permissions\n  * vfs: Add VFS --links command line switch\n  * vfs: add vfs.WriteFile to match os.WriteFile\n  * fs: Move link suffix to fs\n  * cmount: fix problems noticed by linter\n  * mount2: Fix missing . and .. entries\n  * sftp: fix nil check when using auth proxy\n  * Add Martin Hassack to contributors\n  * serve sftp: resolve CVE-2024-45337\n  * googlecloudstorage: typo fix in docs\n  * onedrive: add support for OAuth client credential flow - fixes #6197\n  * lib/oauthutil: add support for OAuth client credential flow\n  * lib/oauthutil: return error messages from the oauth process better\n  * bin/test_backend_sizes.py fix compile flags and s3 reporting\n  * test makefiles: add --flat flag for making directories with many entries\n  * Add divinity76 to contributors\n  * Add Ilias Ozgur Can Leonard to contributors\n  * Add remygrandin to contributors\n  * Add Michael R. Davis to contributors\n  * cmd/mountlib: better snap mount error message\n  * vfs: with --vfs-used-is-size value is calculated and then thrown away - fixes #8220\n  * serve sftp: fix loading of authorized keys file with comment on last line - fixes #8227\n  * oracleobjectstorage: make specifying compartmentid optional\n  * plcoud: fix failing large file uploads - fixes #8147\n  * docs: add docker volume plugin troubleshooting steps\n  * docs: fix missing `state` parameter in `/auth` link in instructions\n  * build: fix build failure on ubuntu\n  * docs: upgrade fontawesome to v6\n  * s3: fix multitenant multipart uploads with CEPH\n  * Add David Seifert to contributors\n  * Add vintagefuture to contributors\n  * use better docs\n  * googlecloudstorage: update docs on service account access tokens\n  * test_all: POSIX head/tail invocations\n  * icloud: Added note about app specific password not working\n  * s3: fix download of compressed files from Cloudflare R2 - fixes #8137\n  * s3: fix testing tiers which don't exist except on AWS\n  * Changelog updates from Version v1.68.2\n  * local: fix permission and ownership on symlinks with --links and --metadata\n  * Revert \"Merge commit from fork\"\n  * Add Dimitrios Slamaris to contributors\n  * Merge commit from fork\n  * onedrive: fix integration tests after precision change\n  * operations: fix TestRemoveExisting on crypt backends by shortening the file name\n  * bisync: fix output capture restoring the wrong output for logrus\n  * serve sftp: update github.com/pkg/sftp to v1.13.7 and fix deadlock in tests\n  * build: fix comments after golangci-lint upgrade\n  * build: update all dependencies\n  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1\n  * pikpak: fix fatal crash on startup with token that can't be refreshed\n  * yandex: fix server side copying over existing object\n  * sugarsync: fix server side copying over existing object\n  * putio: fix server side copying over existing object\n  * onedrive: fix server side copying over existing object\n  * dropbox: fix server side copying over existing object\n  * operations: add RemoveExisting to safely remove an existing file\n  * gofile: fix server side copying over existing object\n  * test_all: try to fix mailru rate limits in integration tests\n  * Add shenpengfeng to contributors\n  * Add Dimitar Ivanov to contributors\n  * docs: fix function name in comment\n  * sftp: allow inline ssh public certificate for sftp\n  * serve s3: fix excess locking which was making serve s3 single threaded\n  * lib/oauthutil: allow the browser opening function to be overridden\n  * Add Moises Lima to contributors\n  * lib/http: disable automatic authentication skipping for unix sockets\n  * onedrive: fix Retry-After handling to look at 503 errors also\n  * s3: Storj provider: fix server-side copy of files bigger than 5GB\n  * s3: add Selectel as a provider\n  * fs: fix Don't know how to set key \"chunkSize\" on upload errors in tests\n  * drive: implement rclone backend rescue to rescue orphaned files\n  * Add tgfisher to contributors\n  * Add Diego Monti to contributors\n  * Add Randy Bush to contributors\n  * Add Alexandre Hamez to contributors\n  * Add Simon Bos to contributors\n  * docs: mention that inline comments are not supported in a filter-file\n  * s3: add Wasabi eu-south-1 region\n  * docs: fix forward refs in step 9 of using your own client id\n  * docs: fix Scaleway Glacier website URL\n  * dlna: fix loggingResponseWriter disregarding log level\n  * build: remove required property on boolean inputs\n  * build: use inputs context in github workflow\n  * s3: fix crash when using --s3-download-url after migration to SDKv2\n  * docs: update overview to show pcloud can set modtime\n  * Add Andr� Tran to contributors\n  * Add Matthias Gatto to contributors\n  * Add lostb1t to contributors\n  * Add Noam Ross to contributors\n  * Add Benjamin Legrand to contributors\n  * s3: add Outscale provider\n  * Add ICloud Drive backend\n  * drive: add support for markdown format\n  * accounting: fix global error acounting\n  * onedrive: fix time precision for OneDrive personal\n  * Add RcloneView as a sponsor\n  * Add Leandro Piccilli to contributors\n  * cache: skip bisync tests\n  * bisync: allow blank hashes on tests\n  * box: fix server-side copying a file over existing dst - fixes #3511\n  * sync: add tests for copying/moving a file over itself\n  * fs/cache: fix parent not getting pinned when remote is a file\n  * gcs: add access token auth with --gcs-access-token\n  * accounting: write the current bwlimit to the log on SIGUSR2\n  * accounting: fix wrong message on SIGUSR2 to enable/disable bwlimit\n  * gphotos: implment --gphotos-proxy to allow download of full resolution media\n  * googlephotos: remove noisy debugging statements\n  * docs: add note to CONTRIBUTING that the overview needs editing in 2 places\n  * test_all: add ignoretests parameter for skipping certain tests\n  * build: replace \"golang.org/x/exp/slices\" with \"slices\" now go1.21 is required\n  * Changelog updates from Version v1.68.1\n  * Makefile: Fail when doc recipes create dir named '$HOME'\n  * Makefile: Prevent `doc` recipe from creating dir named '$HOME'\n  * pikpak: fix cid/gcid calculations for fs.OverrideRemote\n  * bisync: change exit code from 2 to 7 for critically aborted run\n  * cmd: change exit code from 1 to 2 for syntax and usage errors\n  * local: fix --copy-links on macOS when cloning\n  * azureblob: add --azureblob-use-az to force the use of the Azure CLI for auth\n  * azureblob: add --azureblob-disable-instance-discovery\n  * s3: add initial --s3-directory-bucket to support AWS Directory Buckets\n  * Add Lawrence Murray to contributors\n  * backend/protondrive: improve performance of Proton Drive backend\n  * ftp: implement --ftp-no-check-upload to allow upload to write only dirs\n  * docs: document that fusermount3 may be needed when mounting/unmounting\n  * Add rishi.sridhar to contributors\n  * Add quiescens to contributors\n  * docs/zoho: update options\n  * zoho: make upload cutoff configurable\n  * zoho: add support for private spaces\n  * zoho: try to handle rate limits a bit better\n  * zoho: print clear error message when missing oauth scope\n  * zoho: switch to large file upload API for larger files, fix missing URL encoding of filenames for the upload API\n  * zoho: use download server to accelerate downloads\n  * opendrive: add about support to backend\n  * pikpak: fix login issue where token retrieval fails\n  * webdav: nextcloud: implement backoff and retry for 423 LOCKED errors\n  * s3: fix rclone ignoring static credentials when env_auth=true\n  * fs: fix setting stringArray config values from environment variables\n  * rc: fix default value of --metrics-addr\n  * fs: fix --dump filters not always appearing\n  * docs: correct notes on docker manual build\n  * Add ttionya to contributors\n  * build: fix docker release build - fixes #8062\n  * docs: add section for improving performance for s3\n  * onedrive: fix spurious \"Couldn't decode error response: EOF\" DEBUG\n  * Add Divyam to contributors\n  * serve docker: add missing vfs-read-chunk-streams option in docker volume driver\n  * Start v1.69.0-DEV development\n\n- Update to version 1.68.2:\n  * Version v1.68.2\n  * s3: fix multitenant multipart uploads with CEPH\n  * local: fix permission and ownership on symlinks with --links and --metadata\n    CVE-2024-52522 boo#1233422\n  * bisync: fix output capture restoring the wrong output for logrus\n  * build: fix comments after golangci-lint upgrade\n  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1\n  * pikpak: fix fatal crash on startup with token that can't be refreshed\n  * serve s3: fix excess locking which was making serve s3 single threaded\n  * onedrive: fix Retry-After handling to look at 503 errors also\n  * s3: Storj provider: fix server-side copy of files bigger than 5GB\n  * docs: mention that inline comments are not supported in a filter-file\n  * docs: fix forward refs in step 9 of using your own client id\n  * docs: fix Scaleway Glacier website URL\n  * dlna: fix loggingResponseWriter disregarding log level\n  * s3: fix crash when using --s3-download-url after migration to SDKv2\n  * docs: update overview to show pcloud can set modtime\n  * Add RcloneView as a sponsor\n  * accounting: fix wrong message on SIGUSR2 to enable/disable bwlimit\n  * pikpak: fix cid/gcid calculations for fs.OverrideRemote\n  * local: fix --copy-links on macOS when cloning\n  * Start v1.68.2-DEV development\n\n- CVE-2024-51744: updated jwt to v4.5.1 (bsc#1232964).\n","status":"published","published":"2026-04-23T16:22:47Z","modified":"2026-05-19T06:28:55.290679412Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21436-1","title":"Security update for rclone","description":"This update for rclone fixes the following issues:\n\nChanges in rclone:\n\n- Update to version 1.74.4 (boo#1267192):\n  * Version v1.74.4\n  * gui: update embedded release to 1.1.10\n  * local: stop --links symlinks escaping the destination directory CVE-2026-54572\n  * local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw\n  * s3: strip STS security token on same-host HTTPS-\u003eHTTP redirect GHSA-cf44-9pgv-m4xc\n  * serve restic: fix --private-repos isolation bypass CVE-2026-59733\n  * archive extract: fix path traversal letting archives escape the destination CVE-2026-59732\n  * serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v\n  * build: fix multiple CVEs by upgrading to go1.26.5\n  * s3: fix mounting a prefix failing with 403 when HEAD is not permitted\n  * drive, googlephotos: warn when using rclone's shared client_id #9580\n  * drive: fix stray %!(EXTRA) in unexportable google document log message\n  * serve/http: fix --disable-zip so it works over rc\n  * serve webdav: fix MOVE overwrite failing without Overwrite header\n  * fs: fix negative offset when a suffix Range request exceeds object size\n  * accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs\n  * cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets\n  * cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers\n  * cmd/mount2: fix NFS file creation by implementing Mknod\n  * smb: fix for IBM iSeries and signature verification\n  * mega: fix hard deleted files reappearing in listings - fixes #9554\n  * mega: wait for server events after upload, delete and move\n  * vfs: fix hang reopening a file during the handle-caching grace period\n  * s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391\n  * fs: fix command line flag being ignored when set to its default value\n  * docs: fix copy to clipboard functionality for code blocks\n  * fs/operations: correct DeleteFile --backup-dir documentation\n  * build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities\n  * docs: clarify copyto command description - Fixes #9527\n  * docs: fix typo in remote setup docs\n  * serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188\n  * * s3: fix error mapping in GetObject to match HeadObject\n  * filter: fix --files-from copy stopping at the first unreadable file\n  * docs: Fix RELEASE.md\n  * ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0\n  * completion: fix powershell completion corrupting non-ASCII names - fixes #9412\n  * docs/crypt: fix encrypted size example - Fixes #9202\n  * docs: drive: note Google verification exemption for personal use apps\n  * rc: document that rc API access is equivalent to shell access\n  * docs: drive: update documentation about \"Computers\" folder\n  * accounting: fix goroutine leak in ResetCounters\n  * docs: fix --windows-event-log-level help\n  * backend/filelu: fix recursive listing path handling and file filtering\n  * docs: bisync - clarify flag interaction and minor changes\n  * docs: Update RELEASE.md to use cherry-pick -x\n  * webdav: fix mixed property statuses in multi-status responses\n  * s3: remove session token on cross-host redirects\n  * drive: warn when non-exportable Google documents are skipped - #9475\n  * Start v1.74.4-DEV development\n\n- update x/image to 0.43 (bsc#1271056)\n\n- Update to version 1.74.3: (boo#1267869)\n  - Bug Fixes\n    - rc\n      - Fix unauthenticated command execution via --rc-serve inline\n        remotes CVE-2026-49980 (Nick Craig-Wood)\n      - Stop global.* connection string options changing config\n        CVE-2026-49980 (Nick Craig-Wood)\n    - build: Fix multiple CVEs by upgrading to go1.26.4 (Nick\n      Craig-Wood)\n      - CVE-2026-42504: mime: quadratic complexity in\n        WordDecoder.DecodeHeader\n      - CVE-2026-42507: net/textproto: arbitrary input are included\n        in errors without any escaping\n      - CVE-2026-27145: crypto/x509: split candidate hostname only\n        once\n    - log: Fix wrong source file:line in JSON logs from release\n      builds (Nick Craig-Wood)\n    - mount2: Fix empty directory listings on re-read (Janne Beate\n      Bakeng)\n    - serve s3: Fix multipart ListParts pagination returning wrong\n      part numbers (Nick Craig-Wood)\n    - serve sftp\n      - Fix file corruption when a client resumes an upload (Nick\n        Craig-Wood)\n      - Fix truncate request being silently ignored (Nick\n        Craig-Wood)\n    - Local\n      - Fix getXattr returning empty map instead of nil (Leon\n        Brocard)\n  - Drime\n    - Fix server-side copy and move failing with Cloudflare 520\n      error (Nick Craig-Wood)\n    - Fix files being uploaded to the wrong directory (Nick\n      Craig-Wood)\n    - Remove duplicate upload_cutoff config option (Nick\n      Craig-Wood)\n    - Fix directory rename leaving the renamed folder empty in VFS\n      (Nick Craig-Wood)\n  - Drive\n    - Fix server-side move failing on shared drives with duplicate\n      dirs (Nick Craig-Wood)\n  - Iclouddrive\n    - Fix ADP/PCS cookie acquisition for iCloud Drive (Yakov Till)\n    - Fix \"Index has invalid data\" error listing iCloud Photos\n      (Nick Craig-Wood)\n\n- Update to version 1.74.2: (boo#1266210)\n  - Bug Fixes\n    - build\n      - Update golang.org/x/net to v0.55.0 to address:\n        - CVE-2026-42506: html: incorrect handling of namespaced\n          elements in foreign content\n        - CVE-2026-39821: idna: failure to reject ASCII-only\n          Punycode-encoded labels\n        - CVE-2026-42502: html: incorrect handling of HTML elements\n          in foreign content\n        - CVE-2026-25680: html: denial of service when parsing\n          arbitrary HTML\n        - CVE-2026-25681: html: incorrect handling of character\n          references in DOCTYPE nodes\n        - CVE-2026-27136: html: duplicate attributes can cause XSS\n      - Update golang.org/x/crypto to v0.52.0 to address:\n        - CVE-2026-46598: ssh/agent: pathological inputs can lead\n          to client panic\n        - CVE-2026-46597: ssh: byte arithmetic causes underflow and\n          panic\n        - CVE-2026-39828: ssh: bypass of certificate restrictions\n        - CVE-2026-39835: ssh: server panic during\n          CheckHostKey/Authenticate\n        - CVE-2026-39833: ssh/agent: key constraints not enforced\n        - CVE-2026-39832: ssh/agent: agent constraints dropped when\n          forwarding keys\n        - CVE-2026-39827: ssh: memory leak when rejecting channels\n          can lead to DoS\n        - CVE-2026-39830: ssh: client can cause server deadlock on\n          unexpected responses\n        - CVE-2026-39829: ssh: pathological RSA/DSA parameters may\n          cause DoS\n        - CVE-2026-39831: ssh: bypass of FIDO/U2F security keys\n          physical interaction\n        - CVE-2026-39834: ssh: infinite loop on large channel\n          writes\n        - CVE-2026-42508: ssh/knownhosts: auth bypass via\n          unenforced @revoked status\n        - CVE-2026-46595: ssh: VerifiedPublicKeyCallback\n          permissions skip enforcement\n      - update golang.org/x/image to v0.41.0 to address:\n        - CVE-2026-42500: bmp: panic when reading out of bound\n          palette index\n        - CVE-2026-33809: tiff: excessive resource consumption in\n          PackBits decompression\n      - Update golang.org/x/sys to version v0.45.0 to address:\n        - CVE-2026-39824: windows: integer overflow in\n          NewNTUnicodeString\n      - Update github.com/go-git/go-billy/v5 to 5.9.0 to fix\n        CVE-2026-44740\n      - bisync: Fix --conflict-loser pathname with\n        --conflict-resolve newer (nielash)\n      - gui: Update embedded release to 1.1.8 (Nick Craig-Wood)\n      - lib/http: Replace deprecated h2c.NewHandler with\n        http.Server.Protocols (Nick Craig-Wood)\n      - rc: Remove duplicate metrics_addr option registration (Nick\n        Craig-Wood)\n      - vfs/vfscache: Fix silent write failure when mounting with\n        remote:. (Lucky945H)\n    - doc fixes (FTCHD, Iizuki, Leon Brocard, Nick Craig-Wood)\n  - Drime\n    - Fix file doesn't exists error when trying to delete (John\n      Volk)\n    - Fix 500 errors when listing shared folders (Alvinwylim)\n  - Jottacloud\n    - Support whitelabel service Phonero Sky (Tore Anderson)\n  - Protondrive\n    - Fix corrupted on transfer: sha1 hashes differ (William Tange)\n  - S3\n    - Add new MEGA S4 endpoints on megas4.com including\n      Asia-Pacific region (Nick Craig-Wood)\n  - WebDAV\n    - Honour auth_redirect on listAll PROPFIND (Sai Asish Y)\n\n- Update to version 1.74.1:\n  * Version v1.74.1\n  * build: update golang.org/x/net to v0.53.0 to fix CVE-2026-33814\n  * build: fix multiple CVEs by upgrading to go1.26.3\n  * drime: fix uploads of 100..200M files\n  * drime: fix large file uploads landing in drive root instead of configured folder\n  * docs: sponsor updates\n  * s3: add new Fastly Object Storage regions\n  * cloudinary: fix retrying every error and fix pacer sleep units\n  * s3: fix STS call per request by caching AssumeRole credentials\n  * protondrive: fix segfault when copying files missing revision metadata\n  * protondrive: route library logging through rclone's logger\n  * protondrive: route HTTP through rclone's transport\n  * bisync: fix retryable without --resync error message when --resync has a critical failure\n  * cmd/serve/s3: return object listings in key order\n  * Start v1.74.1-DEV development\n\n- Update to version 1.74.0:\n  * Version v1.74.0\n  * docs: add missing Huawei Drive docs\n  * Add Huawei Drive support\n  * s3: add Impossible Cloud as a new S3 provider\n  * build: add `make fetch-gui-and-commit` to fetch and commit the embedded GUI\n  * gui: embed compressed dist.zip in the binary for smaller, reproducible builds\n  * docs: update the GUI docs to reflect the new `rclone gui`\n  * Add John Volk to contributors\n  * drime: fix listings of large directories\n  * docs: fix iCloud docs after website update (missed in the merge)\n  * protondrive: fix server-side moveto and DirMove against current API\n  * build: Update all packages with pseudo versions which aren't v0.0.0\n  * Add Chris Coughlan to contributors\n  * Add Yakov Till to contributors\n  * iclouddrive: add read only  iCloud Photos support and SRP authentication\n  * mountlib: rc: fix mounts created with mountPoint \"*\" overwriting each other\n  * vfs/vfscache/downloaders: kick waiters periodically, not just once\n  * rc: add user directories to core/disks and filter mounts better\n  * docs: notes on how to update pseudo versions\n  * Add dlaumen to contributors\n  * Add Luke Cyca to contributors\n  * Add mathieulongtin to contributors\n  * protondrive: update to latest go-proton-api to use new host\n  * docs: amend Google Drive client_id instructions to include running web-based auth flow\n  * azureblob,azurefile: fix documentation about federated identity\n  * internxt: implement multi-part uploads\n  * serve dlna: remove file extensions from titles to prevent Samsung TV duplication\n  * serve dlna: fix XML quote escaping for Samsung TV compatibility\n  * serve dlna: handle empty ObjectID from Samsung TVs\n  * serve dlna: add Samsung-specific XML namespace\n  * serve dlna: fix invalid dc:date for containers\n  * serve dlna: fix container childCount to reflect actual contents\n  * serve dlna: fix SOAP response argument ordering for Samsung TV compatibility\n  * Add Anton Bordwine to contributors\n  * listremotes: add --exact flag for filtering - fixes #9076\n  * build: bump github.com/Azure/go-ntlmssp to 0.1.1 to fix CVE-2026-32952\n  * azurefiles: fix missing x-ms-file-request-intent header with OAuth - fixes #9367\n  * Add tdawe to contributors\n  * Add Jan Heylen to contributors\n  * protondrive: align backend with newer Proton SDK stack\n  * s3: fix bucket creation failing on Ceph/radosgw\n  * rc: add core/disks to enumerate attached disks\n  * build: update golang.org/x/image/webp to v0.39.0 to fix CVE-2026-33813\n  * Add SyoBoN to contributors\n  * docs: fix typo\n  * docs: fix code comment regarding cmount tag\n  * s3: add HCP provider and list_versions_oldest_first quirk\n  * mega: fix crash when logging in with previous auth keys fails\n  * pcloud: fix recursive listing from the root - fixes #9315\n  * rc: flip auth default so all endpoints require auth unless opted out\n  * Changelog updates from Version v1.73.5\n  * operations: add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179\n  * rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176\n  * rc: add AuthRequired to options/set to prevent auth bypass CVE-2026-41176\n  * accounting: fix rcat/copyurl for files.com\n  * bisync: fix integration tests after sftp log changes\n  * build: bump actions/github-script from 8 to 9\n  * fstest/test_all: stop test servers on signal, panic, or exit\n  * fstest/testserver: add CleanupAll for end-of-run server sweep\n  * fstest/testserver: add force-stop and reconcile stale refcounts\n  * fshttp: add --dump curl for dumping HTTP requests as curl commands\n  * s3: fix empty delimiter parameter rejected by Archiware P5 server\n  * serve nfs: fix EOF flag in READ response not being set when read reaches end of file\n  * webdav: optimize performance by using Depth=0 for metadata requests\n  * bisync: fix flaky TestBisyncConcurrent by increasing random name entropy\n  * azureblob: add --azureblob-decompress flag to download gzip-encoded files\n  * docs: serve backend metadata as JSON on the website\n  * azureblob/auth: add Microsoft Partner Network User-Agent prefix\n  * vfs: add context parameter to New() for config propagation\n  * vfs: replace context.TODO/Background with stored VFS context\n  * build: fix `make fetch-gui` in CI workflow - it was in the wrong place\n  * gui: join Wait goroutines on shutdown\n  * gui: remove flag.Lookup test guard around browser open\n  * gui: drop freePort helper, use libhttp port binding for the RC server\n  * gui: allow serving from a local zip file or an unpacked directory\n  * gui: don't run fetch-gui on make\n  * build: fix GitHub API rate limit errors when fetching GUI dist in CI\n  * drime: fix User.EntryPermissions JSON unmarshalling\n  * filen: make multi-threaded upload chunks individually retryable\n  * chore: add Enduriel as filen backend maintainer\n  * filter: fix debug logs that fire before logger is configured - fixes #9291\n  * Add Mozi to contributors\n  * Add Brais Couce to contributors\n  * gui: new command to launch the https://github.com/rclone/rclone-web/ GUI\n  * s3: fix TencentCOS CDN endpoint failing on bucket check\n  * s3: fix --s3-versions flag ignored by cleanup-hidden when GetBucketVersioning fails\n  * iclouddrive: fix 'directory not found' error when the directory contains accent marks\n  * downloaders: fix flaky TestDownloaders/EnsureDownloader test\n  * sftp: warn the user if no host key validation is configured\n  * Add TheBabu to contributors\n  * lib/http: Add HTTP/2 cleartext support in server configuration\n  * build: add explicit permissions to GitHub Actions workflows\n  * vfscache: fix grace timer reusing stale fd after _checkObject removes cache file\n  * webdav: Add a section on symlink/junction points in the help\n  * Changelog updates from Version v1.73.4\n  * build: update all dependencies\n  * docs: fix XSS vulnerability in dropdown mobile header\n  * build: fix Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder\n  * linkbox: fix downloading files by using web API - fixes #8665\n  * vfs: fix tests after --vfs-handle-caching\n  * Add Suyun to contributors\n  * build: fix loong64 and s390x build\n  * jottacloud: add encoding of percent character to default backend encoding\n  * docs: fix markdown issues in mount docs\n  * docs: fix header level for metadata option\n  * vfs: fix slow nfs serve by adding --vfs-handle-caching\n  * Add Xiangzhe to contributors\n  * Add Mike GIllan to contributors\n  * fix(docs): Fix link to not be language specific\n  * iclouddrive: lowercase Apple ID for SRP authentication\n  * iclouddrive: use dynamic origin for SRP auth headers\n  * iclouddrive: replace plaintext signin with SRP authentication\n  * docs: modernize rclone.org site design\n  * Add Andriy Senyshyn to contributors\n  * Add Claude Opus 4.6 to contributors\n  * Add jinyu.han to contributors\n  * Add jinkeyuu to contributors\n  * Add lif to contributors\n  * Add BizaNator to contributors\n  * Add Patrick Farrell to contributors\n  * Add Jason to contributors\n  * Add ZRHan to contributors\n  * Add Andrew Furman to contributors\n  * Add Andriy Senyshyn to contributors\n  * Add Bhagyashreek8 to contributors\n  * s3: add UCloud Object Storage provider (#9230)\n  * bisync: fix handling of unreadable lockfiles - fixes #9290\n  * librclone/ctest: add Windows support and fix memory management\n  * s3: fix regression where PutObject fails with non-seekable readers\n  * filen: update SDK version\n  * build(deps): bump golang.org/x/image from 0.36.0 to 0.38.0\n  * docs: note macOS 10.15 (Catalina) support with version v1.70.3\n  * Add OVHcloud storage classes\n  * local: remove fadvise calls that cause spinlock contention\n  * Changelog updates from Version v1.73.3\n  * build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2\n  * docs/jottacloud: fix broken link\n  * docs: clarify Filen password change requires updating both password and API key in rclone config\n  * docs: note that Filen API key changes on password change\n  * build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3\n  * webdav: request only required properties in listAll to improve performance\n  * s3: fix Content-MD5 for Object Lock uploads and add GCS quirk\n  * s3: add multi tenant support for Cubbit\n  * lib/rest: fix URLPathEscapeAll breaking WebDAV servers (eg nzbdav) with strict path matching\n  * copyurl: fix ignored --upload-headers and --download-headers\n  * s3: IBM COS: provide ibm_iam_endpoint as a configurable param for IBM IAM-based auth\n  * list: fix nil pointer panic in Sorter when temp file creation fails\n  * docs: update RELEASE procedure to avoid mistakes\n  * Add Billy Hughes to contributors\n  * accounting: Add deletedDirs stat to core/stats help output\n  * docs: added text to the label showing version-introduced info\n  * Changelog updates from Version v1.73.2\n  * fs/log: fix data race on OutputHandler.format field\n  * build(deps): bump docker/build-push-action from 6 to 7\n  * build(deps): bump docker/setup-buildx-action from 3 to 4\n  * build(deps): bump docker/metadata-action from 5 to 6\n  * build(deps): bump docker/setup-qemu-action from 3 to 4\n  * build(deps): bump docker/login-action from 3 to 4\n  * bisync: update changelog\n  * bisync: auto-generate rc help docs\n  * bisync: add more structured info to rc output\n  * bisync: add missing rc params - fixes #7799\n  * operations: multithread copy: grab memory before making go routines\n  * b2: add server side copy real time accounting\n  * s3: add server side copy real time accounting\n  * azureblob: add server side copy real time accounting\n  * operations: add method to real time account server side copy\n  * Add Duncan F to contributors\n  * azureblob: add --azureblob-copy-total-concurrency to limit total multipart copy concurrency\n  * Add razorloves to contributors\n  * docs: fix new drive flag typo in changelog\n  * build: update to golang.org/x/net v0.51.0 to fix CVE-2026-27141 #9220\n  * Add Bjoern Franke to contributors\n  * Add Brian Bockelman to contributors\n  * Add Romāns Potašovs to contributors\n  * Add Adam Kasztenny to contributors\n  * Add hxnd to contributors\n  * Add Bjoern Franke to contributors\n  * Add FTCHD to contributors\n  * build(deps): bump actions/upload-artifact from 6 to 7\n  * build(deps): bump actions/download-artifact from 7 to 8\n  * serve http: add gzip compression\n  * webdav: permit redirects on PROPFIND for metadata\n  * webdav: add missing headers for CORS\n  * docs: Document unsupported S3 object keys with double slashes\n  * touch: add metadata when using `--metadata-set`\n  * s3: ionos: updated regions \u0026 endpoints\n  * s3: scaleway: ONEZONE_IA is available in all zones, GLACIER only in FR-PAR\n  * drive: add integration test for handling folder names with single quotes\n  * http: dark mode for browser\n  * docs: note that --use-server-modtime only works on some backends\n  * Add a1pcm to contributors\n  * Add Leon Brocard to contributors\n  * Add Dark Dragon to contributors\n  * internxt: fix Entry doesn't belong in directory errors on windows\n  * drime: fix chunk-uploaded files ignoring workspace ID\n  * s3: add new Fastly Object Storage regions\n  * docs: Fix headers hierarchy for mount.md\n  * serve http: add fallback embedded favicon\n  * graphics: optimise images losslessly with ImageOptim\n  * docs: update sponsors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Chris to contributors\n  * Add Shlomi Avihou to contributors\n  * Add Jan-Philipp Reßler to contributors\n  * Add Varun Chawla to contributors\n  * Add Prakhar Chhalotre to contributors\n  * s3: add Object Lock support\n  * webdav: escape reserved characters in URL path segments\n  * s3: add Zadara Object Storage provider\n  * bisync: add group Sync to the bisync command\n  * archive: extract: strip \"./\" prefix from tar entry paths\n  * accounting: update String method output format for clarity in transfer rate representation - fixes #9129\n  * docs: add instructions on how to update Go version\n  * build: modernize Go code with go fix for go1.25\n  * build: update all dependencies\n  * lib/rest: remove go1.24 workaround now go1.25 is the minimum\n  * build: update to go1.26 and make go1.25 the minimum required version\n  * Add Jack Kelly to contributors\n  * Changelog updates from Version v1.73.1\n  * build: fix build using go 1.26.0 instead of go 1.25.7\n  * fs/march: fix runtime: program exceeds 10000-thread limit\n  * accounting: fix missing server side stats from core/stats rc\n  * pacer: re-read the sleep time as it may be stale\n  * pacer: fix deadlock between pacer token and --max-connections\n  * test_all: increase retries for Internxt eventual consistency\n  * build: fix CVE-2025-68121 by updating go to 1.25.7 or later - fixes #9167\n  * drime: fix files and directories being created in the default workspace\n  * docs: update sponsors\n  * Add kingston125 to contributors\n  * copyurl: Extend copyurl docs with an example of CSV FILENAMEs starting with a path.\n  * filelu: migrate API calls to lib/rest\n  * internxt: implement re-login under refresh logic, improve retry logic - fixes #9174\n  * docs: add ExchangeRate-API as a sponsor\n  * Add Cohinem to contributors\n  * Add Leon Brocard to contributors\n  * s3: remove StackPath Object Storage provider\n  * drime: implement About\n  * build: bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.5 to fix GO-2026-4316\n  * Set list_version to 2 for FileLu S3 configuration\n  * filelu: add multipart upload support with configurable cutoff\n  * filelu: add multipart init response type\n  * filelu: add comment for response body wrapping\n  * filelu: avoid buffering entire file in memory\n  * docs: update sponsor logos\n  * s3: add Fastly Object Storage provider\n  * filen: fix potential panic in case of error during upload\n  * filen: fix 32 bit targets not being able to list directories Fixes #9142\n  * pikpak: support custom filenames for addurl backend command - fixes #9111\n  * Start v1.74.0-DEV development\n","status":"published","published":"2026-07-22T20:54:49Z","modified":"2026-07-24T17:16:08.404400958Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21761-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:30:23Z","modified":"2026-09-09T18:23:14.573173825Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23625-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5026 CVE-2026-39821\n  * GO-2026-6225\n  * GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw\n  * GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h\n  * GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q\n  * GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6\n  * GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86\n  * GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p\n  * GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6\n  * GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68\n  * GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v\n  * GO-2026-6262 GHSA-22w5-2fxg-vrwx\n  * GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28\n  * GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j\n  * GO-2026-6265 GHSA-8fxq-53rx-ph5f\n  * GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m\n  * GO-2026-6267 GHSA-h58c-xccx-75m3\n  * GO-2026-6268 GHSA-q9c5-pp7m-fm2g\n  * GO-2026-6269 GHSA-rxhg-vcww-2mpw\n  * GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5\n  * GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m\n  * GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97\n  * GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28\n  * GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w\n  * GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34\n  * GO-2026-6277 GHSA-4ph6-mjv7-3fq6\n  * GO-2026-6278 GHSA-w67g-5rqw-f597\n  * GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v\n  * GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw\n  * GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4\n  * GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9\n  * GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q\n  * GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg\n  * GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr\n  * GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4\n  * GO-2026-6287 GHSA-vx2m-jpxr-xv7w\n  * GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr\n  * GO-2026-6289 GHSA-w8j7-39hp-8x59\n  * GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3\n  * GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58\n  * GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m\n  * GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq\n  * GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff\n  * GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx\n  * GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9\n  * GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm\n  * GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp\n  * GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px\n  * GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf\n  * GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf\n\n- Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-4720 GHSA-v3mg-9v85-fcm7\n  * GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc\n  * GO-2026-4950\n  * GO-2026-6093 GHSA-464c-974j-9xm6\n  * GO-2026-6094 GHSA-gcjh-h69q-9w9g\n  * GO-2026-6095 GHSA-r277-6w6q-xmqw\n  * GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737\n  * GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv\n  * GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q\n  * GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv\n  * GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf\n  * GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8\n  * GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp\n  * GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp\n  * GO-2026-6105 GHSA-c534-2w9c-x7fm\n  * GO-2026-6106 GHSA-v6w6-358x-2433\n  * GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3\n  * GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq\n  * GO-2026-6109 GHSA-86cx-wwf4-phq4\n  * GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75\n  * GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h\n  * GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq\n  * GO-2026-6113 GHSA-p6ph-3jx2-3337\n  * GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8\n  * GO-2026-6115 CVE-2026-56867\n  * GO-2026-6117 GHSA-hp74-gm6m-2qm5\n  * GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7\n  * GO-2026-6119 CVE-2026-43983 GHSA-w6p7-2fxx-4f44\n  * GO-2026-6120 CVE-2026-54593 GHSA-8r6w-3qq5-4p4r\n  * GO-2026-6121 CVE-2026-54345 GHSA-6r28-9ppf-4hj5\n  * GO-2026-6122 CVE-2026-54332 GHSA-g6v3-7xmc-w563\n  * GO-2026-6123 CVE-2026-49446 GHSA-2rx5-2g7j-2659\n  * GO-2026-6124 CVE-2026-49447 GHSA-5fqm-cc34-fcf5\n  * GO-2026-6125 CVE-2026-11479 GHSA-6h35-9p2w-3j3r\n  * GO-2026-6126 CVE-2026-11465 GHSA-7v3v-cp44-vc8m\n  * GO-2026-6127 CVE-2026-50567 GHSA-q6vm-xqc9-v3ff\n  * GO-2026-6128 CVE-2026-11481 GHSA-q76h-p6jh-9rw3\n  * GO-2026-6129 CVE-2026-50570 GHSA-qf5v-m7p4-95rp\n  * GO-2026-6130 CVE-2026-50568 GHSA-r5jh-q2mw-gcx4\n  * GO-2026-6131 CVE-2026-50569 GHSA-vchh-r53j-8mpw\n  * GO-2026-6132 CVE-2026-62325 GHSA-rjrw-mjq6-hpmm\n  * GO-2026-6133 CVE-2026-54719 GHSA-rmxw-pq4x-3fvh\n  * GO-2026-6134 CVE-2026-66064 GHSA-964w-f6gj-5236\n  * GO-2026-6135 CVE-2026-54650 GHSA-fh2f-xfxc-q9cc\n  * GO-2026-6136 CVE-2026-64863 GHSA-hq33-8jgp-8qq3\n  * GO-2026-6137 CVE-2026-66063 GHSA-wg2q-39h6-66x9\n  * GO-2026-6138 CVE-2026-54638 GHSA-whmm-qj9r-wvr2\n  * GO-2026-6139 CVE-2026-54735 GHSA-4p3g-4hcj-wpvx\n  * GO-2026-6140 CVE-2026-11500 GHSA-jqpm-wf57-qx5c\n  * GO-2026-6141 CVE-2026-54693 GHSA-jq8w-8q2f-ffm9\n  * GO-2026-6142 CVE-2026-54680 GHSA-mjqf-28ph-426h\n  * GO-2026-6143 GHSA-xvg2-cgv6-6h7v\n  * GO-2026-6144 CVE-2026-67439 GHSA-jm28-2wcr-qf3h\n  * GO-2026-6145 CVE-2026-67438 GHSA-xc5w-4v5w-7x65\n  * GO-2026-6146 CVE-2026-67437 GHSA-xpxj-f2fm-rqch\n  * GO-2026-6147 CVE-2026-25688 GHSA-hmr2-99jm-8x45\n  * GO-2026-6148 CVE-2026-25699 GHSA-w754-5646-xq9j\n  * GO-2026-6151 CVE-2026-34033 GHSA-6qwm-5fm9-cvjx\n  * GO-2026-6152 CVE-2026-34905 GHSA-85r2-pvg8-89r9\n  * GO-2026-6153 CVE-2026-33582 GHSA-v553-g2w6-295p\n  * GO-2026-6154 CVE-2026-34031 GHSA-x4f6-mqg6-28xx\n  * GO-2026-6155 CVE-2026-65834 GHSA-68cj-mvg9-rgm2\n  * GO-2026-6156 CVE-2026-52856 GHSA-ghrq-5wpp-hxx5\n  * GO-2026-6157 CVE-2026-65835 GHSA-jr6p-8pjj-mfx6\n  * GO-2026-6158 CVE-2026-52855 GHSA-pfvc-3p5h-x7h6\n  * GO-2026-6159 CVE-2026-52857 GHSA-q6hh-gp44-4hcm\n  * GO-2026-6160 CVE-2026-54725 GHSA-r2v3-8gwf-7ghm\n  * GO-2026-6161 CVE-2026-53551 GHSA-qj55-47fp-p62j\n  * GO-2026-6162 CVE-2026-54787 GHSA-wqqc-jjcq-vfxm\n  * GO-2026-6163 CVE-2026-54909 GHSA-34rh-wp3j-6cxc\n  * GO-2026-6164 CVE-2026-54910 GHSA-vvp7-h4fj-m28w\n  * GO-2026-6165 CVE-2026-54908 GHSA-wg4g-wm44-ch5j\n  * GO-2026-6166 CVE-2026-56868\n  * GO-2026-6168 CVE-2026-56869\n  * GO-2026-6169 CVE-2026-56870\n  * GO-2026-6170 CVE-2026-56871\n  * GO-2026-6171 CVE-2026-56872\n  * GO-2026-6172 CVE-2026-56873\n  * GO-2026-6173 CVE-2026-56874\n  * GO-2026-6181 GHSA-gwfq-86j8-7qhv\n  * GO-2026-6182 CVE-2026-71312 GHSA-2m8m-jhrm-w6j2\n  * GO-2026-6183 GHSA-3x6r-wxxg-53vv\n  * GO-2026-6184 CVE-2026-71309 GHSA-45pq-889g-fcgh\n  * GO-2026-6185 CVE-2026-59732 GHSA-4vr5-p2gc-h23p\n  * GO-2026-6186 CVE-2026-71313 GHSA-7p4m-qxvv-g567\n  * GO-2026-6187 CVE-2026-71311 GHSA-8c48-q9wj-3w37\n  * GO-2026-6188 GHSA-8mxv-9xhp-86h4\n  * GO-2026-6189 GHSA-8v25-v8p6-qf7v\n  * GO-2026-6190 GHSA-945v-v9p3-v5xw\n  * GO-2026-6191 CVE-2026-54572 GHSA-cf44-9pgv-m4xc\n  * GO-2026-6192 CVE-2026-65602 GHSA-42cj-m3vj-89wv\n  * GO-2026-6195 CVE-2026-59733 GHSA-fqj9-69pf-6pjg\n  * GO-2026-6196 GHSA-gx4c-2hqx-cw2r\n  * GO-2026-6197 GHSA-h4mf-4v27-hggj\n  * GO-2026-6198 CVE-2026-65601 GHSA-qq9q-x9w4-chhj\n  * GO-2026-6199 CVE-2026-71310 GHSA-xhf4-832v-7xcr\n  * GO-2026-6201 CVE-2026-71324 GHSA-3ccp-42pg-hgv6\n  * GO-2026-6202 CVE-2026-54764 GHSA-3q9r-p662-5j8m\n  * GO-2026-6203 CVE-2026-71325 GHSA-62fc-8686-hfmq\n  * GO-2026-6204 CVE-2026-71326 GHSA-6765-c87h-8mrf\n  * GO-2026-6205 CVE-2026-54765 GHSA-6p8f-p8j2-rqmv\n  * GO-2026-6207 CVE-2026-67309 GHSA-8rxv-jg7p-wvg3\n  * GO-2026-6208 CVE-2026-65600 GHSA-cxjq-mrr5-89rv\n  * GO-2026-6209 CVE-2026-71327 GHSA-fgjj-px3w-67xx\n  * GO-2026-6211 CVE-2026-54763 GHSA-x677-9fxg-v5c5\n  * GO-2026-6212 CVE-2026-39904 GHSA-42jc-v69j-g38f\n  * GO-2026-6213 CVE-2026-71556 GHSA-hc8v-wwc9-vgxm\n  * GO-2026-6214 CVE-2026-71557 GHSA-qgq7-7hm3-q39j\n  * GO-2026-6216\n  * GO-2026-6219 CVE-2026-73080 GHSA-87fv-vqqr-m4jr\n  * GO-2026-6220 CVE-2026-48786 GHSA-88p2-jj8w-j8qg\n  * GO-2026-6221 CVE-2026-54917 GHSA-w62w-66v9-vvgv\n  * GO-2026-6223 CVE-2026-54526 GHSA-48p8-g2fx-3wwm\n  * GO-2026-6224 CVE-2026-53469 GHSA-6xvf-9742-48w2\n  * GO-2026-6227 CVE-2026-35511 GHSA-29rf-f4vv-pvq6\n  * GO-2026-6228 CVE-2026-53471 GHSA-2fqw-7c6r-2cq6\n  * GO-2026-6229 CVE-2026-53470 GHSA-v5m8-5455-qw2x\n  * GO-2026-6230 CVE-2026-53657 GHSA-2j9v-p4xj-cjw2\n  * GO-2026-6231 CVE-2026-53476 GHSA-7j4w-x8x8-5mvg\n  * GO-2026-6232 CVE-2026-53475 GHSA-8g5p-jxp9-457c\n  * GO-2026-6233 CVE-2026-53474 GHSA-vf2h-7x3w-97fr\n  * GO-2026-6234 CVE-2026-53658 GHSA-xghw-p77p-3r7x\n  * GO-2026-6237\n  * GO-2026-6238 CVE-2026-10722 GHSA-xhgw-qwwf-pg32\n  * GO-2026-6240 CVE-2026-64859 GHSA-6x2c-phff-wx57\n  * GO-2026-6241 CVE-2026-45099 GHSA-8394-6f8r-whxg\n  * GO-2026-6242 CVE-2026-71479 GHSA-8r8v-xf7q-rcpr\n  * GO-2026-6243 CVE-2026-64865 GHSA-j6gc-4893-qwmp\n  * GO-2026-6244 CVE-2026-64866 GHSA-p845-629j-rcj6\n  * GO-2026-6245 CVE-2026-64868 GHSA-v828-m3pf-vq9q\n  * GO-2026-6246 GHSA-fhgh-wq4q-r37x\n  * GO-2026-6247 CVE-2026-55062 GHSA-m6jg-wr9m-cg2f\n  * GO-2026-6248 CVE-2026-55061 GHSA-qmcq-xw74-w667\n  * GO-2026-6249 CVE-2026-25700 GHSA-4gw2-vg4x-7p29\n\n- Update to version 0.0.20260814T162254 2026-08-14T16:22:54Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5021 CVE-2026-42508 GHSA-5cgq-3rg8-m6cv\n  * GO-2026-5942 CVE-2026-46600\n  * GO-2026-5972 CVE-2026-33818\n  * GO-2026-6088 CVE-2026-56859\n  * GO-2026-6089 CVE-2026-56853\n  * GO-2026-6090 CVE-2026-56862\n  * GO-2026-6091 CVE-2026-56858\n  * GO-2026-6179 CVE-2026-56865\n  * GO-2026-6180 CVE-2026-56864\n  * GO-2026-6218 CVE-2026-56860\n  * GO-2026-6222 CVE-2026-46603\n\n- Update to version 0.0.20260811T232133 2026-08-11T23:21:33Z.\n\n  Go CVE Numbering Authority IDs added or updated with aliases:\n\n  * GO-2026-5005 CVE-2026-39833 GHSA-jppx-rxg9-jmrx\n  * GO-2026-5006 CVE-2026-39832 GHSA-f5wc-c3c7-36mc\n  * GO-2026-5075 CVE-2026-57210 GHSA-38x9-25wx-7fg2\n  * GO-2026-5119 CVE-2026-48119 GHSA-4g6j-g789-rghm\n  * GO-2026-5152 CVE-2026-48491 GHSA-5r4w-85f3-pw66\n  * GO-2026-5274 CVE-2026-40173 GHSA-95mq-xwj4-r47p\n  * GO-2026-5287 CVE-2026-53622 GHSA-9cr8-q42q-g8m7\n  * GO-2026-5306 CVE-2026-34179 GHSA-c3h3-89qf-jqm5\n  * GO-2026-5368 CVE-2026-34177 GHSA-fm2x-c5qw-4h6f\n  * GO-2026-5466 CVE-2026-41179 GHSA-jfwf-28xr-xw6q\n  * GO-2026-5516 CVE-2026-41327 GHSA-mrxx-39g5-ph77\n  * GO-2026-5529 CVE-2026-34976 GHSA-p5rh-vmhp-gvcw\n  * GO-2026-5532 CVE-2026-41181 GHSA-p6hg-qh38-555r\n  * GO-2026-5576 CVE-2026-34178 GHSA-q96j-3fmm-7fv4\n  * GO-2026-5596 CVE-2026-49980 GHSA-qw24-gh76-8rvv\n  * GO-2026-5668 CVE-2026-41568 GHSA-vp62-88p7-qqf5\n  * GO-2026-5970 CVE-2026-56852\n","status":"published","published":"2026-09-04T12:32:03Z","modified":"2026-09-29T18:23:20.110594263Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}