{"apiVersion":"1.0","identifier":"CVE-2026-79775","description":"rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service vulnerabilities in the archive backend-s SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata stream). Variants 1 and 2 terminate the rclone process and, via -rclone serve sftp-, can crash the entire SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client must address or descend into the malicious archive object to trigger it.","publishedAt":"2026-08-25T16:17:29","lastModifiedAt":"2026-08-25T17:18:18","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79775","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.00307,"riskScore":0.67,"affectedProduct":"rclone","affectedVersions":">=1.72.0,<=1.74.4","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-79775","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-79775","en":"https://www.redsauce.net/en/cves/CVE-2026-79775","fr":"https://www.redsauce.net/fr/cves/CVE-2026-79775","pt":"https://www.redsauce.net/pt/cves/CVE-2026-79775","de":"https://www.redsauce.net/de/cves/CVE-2026-79775","sk":"https://www.redsauce.net/sk/cves/CVE-2026-79775","el":"https://www.redsauce.net/el/cves/CVE-2026-79775"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-79775"}}