rclone vulnerabilities (openSUSE)
79 vulnerabilities.
-
rcloneopenSUSE HTTP/2 server crash due to HPACK encoder race in net/http 7.5 High -
rcloneopenSUSE Reject malformed ECH outer extension references in crypto/tls 7.5 High -
rcloneopenSUSE Recognize yield as regexp preceder keyword in html/template 6.1 Medium -
rcloneopenSUSE Reset context tracking on consecutive template expressions in html/template 6.1 Medium -
rcloneopenSUSE Checksum database bypass for golang.org/toolchain in cmd/go 7.8 High -
rcloneopenSUSE Checksum bypass for golang.org/fips140 in cmd/go 7.8 High -
rcloneopenSUSE Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart 7.5 High -
rcloneopenSUSE HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http 7.5 High -
rcloneopenSUSE Excessive CPU consumption from repeated initial window changes in net/http 7.5 High -
rcloneopenSUSE Lack of limit on size of parsed Range headers in net/http 7.5 High -
rcloneopenSUSE Double flow control refund on HTTP/2 server streams in net/http 9.1 Critical -
rcloneopenSUSE HTTP/2 transport accepts malformed framing-related headers in net/http 7.5 High -
rcloneopenSUSE HTTP/2 server memory exhaustion due to Trailer headers in net/http 7.5 High -
rcloneopenSUSE HTTP/1 client connection desynchronization after CONNECT rejection in net/http 7.5 High -
rcloneopenSUSE Root.Mkdir(All) can follow junctions out of the root on Windows in os 9.8 Critical -
rcloneopenSUSE gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers 8.7 High -
rcloneopenSUSE Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh 7.5 High -
rcloneopenSUSE Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh 7.5 High -
rcloneopenSUSE Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh 7.5 High -
rcloneopenSUSE Excessive memory allocation during VP8L decoding in golang.org/x/image 7.5 High -
rcloneopenSUSE Limit handshake messages we are willing to accept post-handshake in crypto/tls 7.5 High -
rcloneopenSUSE Avoid quadratic complexity in resolvePath in net/url 5.9 Medium -
rcloneopenSUSE Add recursion depth guard during decode in encoding/xml 7.5 High -
rcloneopenSUSE Fix Javascript regexp context tracking in html/template 6.1 Medium -
rcloneopenSUSE Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http 7.5 High -
rcloneopenSUSE Enforce maximum recursion depth in encoding/asn1 7.5 High -
rcloneopenSUSE Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage 7.5 High -
rcloneopenSUSE rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories 8.8 High -
rcloneopenSUSE rclone archive extract allows S3 destination prefix escape via crafted archive paths 5.0 Medium -
rcloneopenSUSE rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote 7.5 High -
rcloneopenSUSE Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix 9.8 Critical -
rcloneopenSUSE Arbitrary inputs are included in errors without any escaping in net/textproto 5.3 Medium -
rcloneopenSUSE Quadratic complexity in WordDecoder.DecodeHeader in mime 7.5 High -
rcloneopenSUSE Inefficient candidate hostname parsing in crypto/x509 6.5 Medium -
rcloneopenSUSE Panic when reading out of bound palette index in golang.org/x/image/bmp 5.3 Medium -
rcloneopenSUSE Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows 3.3 Low -
rcloneopenSUSE Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html 6.1 Medium -
rcloneopenSUSE Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html 6.1 Medium -
rcloneopenSUSE Invoking duplicate attributes can cause XSS in golang.org/x/net/html 6.1 Medium -
rcloneopenSUSE Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html 6.1 Medium -
rcloneopenSUSE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 6.5 Medium -
rcloneopenSUSE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent 5.3 Medium -
rcloneopenSUSE Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh 7.5 High -
rcloneopenSUSE Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh 10.0 Critical -
rcloneopenSUSE Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts 9.1 Critical -
rcloneopenSUSE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh 5.3 Medium -
rcloneopenSUSE Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh 9.1 Critical -
rcloneopenSUSE Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent 9.1 Critical -
rcloneopenSUSE Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent 9.1 Critical -
rcloneopenSUSE Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh 9.1 Critical - Show olderLoading…