CVE-2026-79775

Name of the Vulnerable Software and Affected Versions rclone versions 1.72.0 through 1.74.4

Description Multiple denial-of-service issues exist in the archive backend's SquashFS parser, which utilizes the github.com/diskfs/go-diskfs dependency. The parser does not validate attacker-controlled superblock and metadata values. An attacker capable of placing or modifying a SquashFS image in storage exposed via an rclone :archive: remote can create a malicious image to trigger an integer division-by-zero panic through a zero block size, an out-of-bounds slice panic via an out-of-range inode metadata offset, or a non-progress CPU loop caused by a truncated metadata stream. The first two scenarios terminate the process and can crash an SFTP server when using rclone serve sftp, while the third causes sustained CPU consumption. Because parsing is lazy, the issue is triggered when a victim or remote client accesses or descends into the malicious archive object.

Recommendations Update rclone to version 1.75.0.