rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory (CVE-2026-71310)

The rclone HTTP CONNECT helper uses Go's http.ReadResponse without enforcing limits on response header size, allowing a proxy to send excessively large headers that cause unbounded memory growth. The vulnerability arises because the helper does not apply MaxResponseHeaderBytes or equivalent limits, nor does it set handshake deadlines. This can lead to process termination due to out-of-memory conditions when parsing large or multiple oversized CONNECT response headers. The issue affects rclone versions before 1.75.0. The attack requires a configured malicious or compromised proxy or an on-path attacker controlling a plaintext HTTP proxy hop. HTTPS proxy connections mitigate on-path attacks by requiring proxy authentication. The vulnerability impacts FTP and SFTP backends that use this helper. Remediation involves enforcing header size limits, handshake deadlines, and proper connection handling to prevent memory exhaustion.

Exploitation can cause the rclone process to exhaust memory and terminate, disrupting unrelated FTP and SFTP operations. This denial of service affects the entire process and cannot be contained by panic recovery. There is no loss of confidentiality or integrity, as the attacker must already control the proxy or be on-path for a plaintext proxy connection. HTTPS proxy authentication limits the feasibility of on-path attacks. The impact is rated medium severity with a CVSS score of 5.9, reflecting a denial of service condition requiring user interaction (proxy configuration).

A patch is available that enforces a fixed total size limit on CONNECT response headers and sets handshake deadlines to prevent unbounded memory growth. The fix also closes connections on oversized or malformed responses and ensures buffered tunnel bytes are safely consumed. Users should upgrade to rclone version 1.75.0 or later where these protections are implemented. Until patched, users should avoid configuring untrusted or compromised proxies and prefer HTTPS proxies with authentication to reduce attack surface.