THREAT OPS › Threat News › [GHSA] GHSA-xhf4-832v-7xcr (medium) — rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
[GHSA] GHSA-xhf4-832v-7xcr (medium) — rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
GHSA-xhf4-832v-7xcr Severity: medium CVE: CVE-2026-71310
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
## 1. Summary
The shared HTTP CONNECT helper parses a proxy response with `http.ReadResponse` over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised config
Indicators of compromise
- a0c09f1381ae93e2a9a33c529d170186c61ad058sha1
- 961266888fe797390c535386f3b3aa46f4853602sha1
- CVE-2026-71310cve
Original source: https://github.com/advisories/GHSA-xhf4-832v-7xcr