CVE-2026-71310: rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go p

mediumCVSS 5.9CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP proxy hop, to send oversized headers that grow memory until the rclone process fails. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches the parser before SSH server authentication, so target host key validation does not constrain a malicious proxy. This issue is fixed in 1.75.0.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 5.9
Published: 2026-08-05
Last updated: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-71310

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-713100.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-71310	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for rclone is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

high[NEW] [high] rclone: Multiple Vulnerabilitiescert-bund · 2026-08-06
mediumCVE-2026-71313: rclone is a command-line program to sync files and directories to and from different cloud sto…nvd · 2026-08-05
highCVE-2026-71312: rclone is a command-line program to sync files and directories to and from different cloud sto…nvd · 2026-08-05
mediumCVE-2026-71311: rclone is a command-line program to sync files and directories to and from different cloud sto…nvd · 2026-08-05
unknownCVE-2026-71309: rclone is a command-line program to sync files and directories to and from different cloud sto…nvd · 2026-08-05
mediumGHSA-7p4m-qxvv-g567: rclone: Local Encoding Path Traversalghsa · 2026-08-05