rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS… (CVE-2026-79775)

rclone versions >= 1.72.0 and <= 1.74.4 have multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which depends on github.com/diskfs/go-diskfs. The parser does not validate superblock and metadata values before use, allowing an attacker who can place or modify a SquashFS image in storage exposed via an rclone :archive: remote to craft malicious images. These images can trigger an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). The first two variants cause the rclone process or the entire SFTP server (when using 'rclone serve sftp') to crash, while the third causes sustained CPU consumption. The parsing is lazy, so the vulnerability is triggered only when the malicious archive object is accessed or descended into.

Successful exploitation results in denial-of-service conditions by crashing the rclone process or the SFTP server or causing sustained high CPU usage. There is no impact on confidentiality or integrity reported. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact limited to availability.

A fix is available in rclone version 1.75.0. Users should upgrade to version 1.75.0 or later to remediate these vulnerabilities. Until upgraded, avoid exposing untrusted SquashFS images via the :archive: remote, or restrict access to trusted users only.