CVE-2026-71310

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0

Description The shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses using http.ReadResponse over an unrestricted buffered reader. This allows a malicious or compromised proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers. This action causes memory growth until the process fails. The issue affects FTP and SFTP proxy connections; specifically, for SFTP, the parser is reached before SSH server authentication, meaning target host key validation cannot prevent a malicious proxy from triggering the failure.

Recommendations Update to version 1.75.0.