{"uuid": "39872836-157e-4d62-bde7-3e5190d77687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3X6R-WXXG-53VV", "type": "seen", "source": "https://gist.github.com/alon710/164398037554120d630a453295ebf3cc", "content": "# GHSA-3X6R-WXXG-53VV: GHSA-3x6r-wxxg-53vv: Process-Fatal Nil Pointer Dereference in rclone WebDAV TUS Upload Backend\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/GHSA-3X6R-WXXG-53VV\n\n## Summary\nA critical process-fatal NULL pointer dereference vulnerability exists in the WebDAV backend of rclone (when configured with ownCloud Infinite Scale TUS uploads). During transport failures, a nil HTTP response pointer is dereferenced directly without validation, leading to an unhandled Go runtime panic that terminates the entire rclone daemon. This vulnerability was resolved in rclone version 1.75.0.\n\n## TL;DR\nUncaught nil-pointer dereference in rclone's WebDAV backend causes immediate process-wide crashes (denial of service) when a TUS upload encounters a pre-response transport or network failure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-476 (NULL Pointer Dereference) / CWE-248 (Uncaught Exception)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.3 (Medium)\n- **EPSS Score**: N/A (No CVE assigned)\n- **Impact**: Application crash / Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept / Local Reproducer\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- rclone with ownCloud Infinite Scale WebDAV backend using TUS uploads\n- **rclone**: <= 1.74.0 (Fixed in: `1.75.0`)\n\n## Mitigation\n\n- Upgrade rclone to version 1.75.0 or later.\n- Disable ownCloud Infinite Scale TUS-based transfers on untrusted networks or avoid uploading to unverified WebDAV endpoints if upgrading is delayed.\n- Implement local process monitoring daemons (systemd, supervisord) to handle automatic recovery of crashed rclone mounts.\n\n**Remediation Steps:**\n1. Identify running rclone daemon and mount instances using command: ps aux | grep rclone\n2. Download and install rclone version 1.75.0 or later from the official repository.\n3. Restart all active rclone mounts or background syncing daemons to apply the patched binary.\n4. Verify stability by running rclone against an inactive local port to ensure it fails gracefully without panicking.\n\n## References\n\n- [GitHub Security Advisory GHSA-3x6r-wxxg-53vv](https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv)\n- [Advisory Database Entry](https://github.com/advisories/GHSA-3x6r-wxxg-53vv)\n- [Vulnerability Fix Commit](https://github.com/rclone/rclone/commit/5871d98c368751a6d992ed64f8cd22cb78c44cee)\n- [Rclone Release v1.75.0](https://github.com/rclone/rclone/releases/tag/v1.75.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-3X6R-WXXG-53VV) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T15:31:19.585107Z"}