THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-xhf4-832v-7xcr (medium) — rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

[GHSA] GHSA-xhf4-832v-7xcr (medium) — rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

highgithub_advisoriesPublished 2026-08-05

GHSA-xhf4-832v-7xcr Severity: medium CVE: CVE-2026-71310

rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

## 1. Summary

The shared HTTP CONNECT helper parses a proxy response with `http.ReadResponse` over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised config

Indicators of compromise

Original source: https://github.com/advisories/GHSA-xhf4-832v-7xcr