Listen to this Post
The shared HTTP CONNECT helper in rclone, located in lib/proxy/http.go, is responsible for parsing proxy responses when establishing tunnels for protocols like FTP and SFTP. This helper invokes `http.ReadResponse(br, req)` directly over an unrestricted buffered reader.
The root cause is that this call does not inherit http.Transport.MaxResponseHeaderBytes. In the Go standard library, `textproto.Reader.ReadMIMEHeader` passes `math.MaxInt64` limits, and `textproto.NewReader` explicitly warns callers to use `io.LimitReader` or an equivalent bound for denial-of-service resistance. Rclone supplies no such bound or total CONNECT-handshake deadline.
A malicious or compromised configured proxy, or an active on-path actor controlling a plaintext HTTP-proxy hop, can send an HTTP CONNECT response with oversized headers—for example, a 2 MiB `X-Fill` header—which the helper parses and accepts without a fixed ceiling. This causes memory to grow until the rclone process fails. The helper also returns the raw connection, so a safe remediation must preserve any tunnel bytes already buffered after the CONNECT response.
The security impact is process-wide exhaustion, not loss of access through the malicious proxy (which the proxy already controls). The victim must configure and use the proxy, so UI is Required and the rating is Medium. The affected helper is used by FTP and SFTP proxy connections, and SFTP reaches this parser before SSH server authentication, so target host-key validation does not constrain a malicious proxy. HTTPS proxy authentication does constrain ordinary on-path attackers.
DailyCVE Form:
Platform: Rclone
Version: < 1.75.0
Vulnerability: Unbounded Memory Exhaustion
Severity: Medium (CVSS 5.9)
date: 2026-08-05
Prediction: 2026-08-05 (fixed)
What Undercode Say: Analytics
The following commands and code snippets demonstrate the vulnerable code path and the proof-of-concept.
1. Vulnerable Code Location
Affected file and line range lib/proxy/http.go:23-81
2. Proof-of-Concept (PoC) Setup
Configure rclone to use a test proxy (e.g., using environment variable) export HTTP_PROXY=http://malicious-proxy:8080 export HTTPS_PROXY=http://malicious-proxy:8080 Run rclone with a command that triggers CONNECT (e.g., SFTP or FTP remote) rclone ls sftp:remote:/path
3. Malicious Proxy Response (simplified)
The proxy accepts rclone’s CONNECT request and returns:
HTTP/1.1 200 Connection Established X-Fill: [2 MiB of data]
4. Go Code Snippet Showing the Vulnerability
// lib/proxy/http.go (simplified)
func HTTPConnectDial(proxyURL url.URL, dialer func(string, string) (net.Conn, error)) func(context.Context, string, string) (net.Conn, error) {
return func(ctx context.Context, network, addr string) (net.Conn, error) {
// ... (connection setup)
req := &http.Request{
Method: "CONNECT",
URL: &url.URL{Opaque: addr},
Host: addr,
Header: make(http.Header),
}
// ... (write request)
resp, err := http.ReadResponse(br, req) // VULNERABLE: no size limit
// ...
}
}
Exploit
An attacker with control over a proxy server configured by the victim (or an on-path attacker for plaintext HTTP) can send a CONNECT response with extremely large headers. The `http.ReadResponse` function will read and buffer these headers without any enforced limit, causing memory consumption to grow linearly with the header size. Multiple concurrent CONNECT requests can accelerate the exhaustion, leading to an Out-Of-Memory (OOM) condition that terminates the rclone process. Because the parser is invoked before SFTP server authentication, even a proxy that is not trusted by the SFTP server can trigger the vulnerability.
Protection
- Upgrade to rclone version 1.75.0 or later, where the fix has been implemented.
- Enforce a total CONNECT status/header budget before parsing.
- Add a fixed total handshake deadline as well as idle deadlines.
- Close the connection on an oversized or malformed response.
- Return a wrapper that consumes already buffered post-response tunnel bytes before the raw connection.
- Test large single/multiple headers, slow streaming, and concurrent handshakes.
- As a workaround, avoid using plaintext HTTP proxies with rclone, or restrict proxy usage to trusted, controlled environments.
Impact
- Denial of Service: Large or concurrent CONNECT responses can terminate the rclone process, interrupting unrelated FTP/SFTP remotes and mounts.
- Uncontainable OOM: Runtime OOM cannot be contained by RC panic recovery.
- Bypasses Host-Key Validation: SFTP reaches the parser before SSH server authentication, so target host-key validation does not constrain a malicious proxy.
- Limited by TLS: HTTPS proxy connections authenticate the proxy before this response is parsed, so an on-path actor must also defeat TLS.
- Requires User Interaction: The victim must configure and use the malicious proxy, so the attack is not fully remote without prior compromise or social engineering.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
