815 matches found
CVE-2026-50018
Hoverfly (open source API simulation tool) prior to version 1.12.8 is vulnerable to denial of service via a goroutine leak in its remote post-serve actions . The root cause is the use of http.DefaultClient without any timeout configuration: when the remote endpoint is unreachable or intentionally...
Linux Distros Unpatched Vulnerability : CVE-2026-88018
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with...
Linux Distros Unpatched Vulnerability : CVE-2026-88045
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed...
GHSA-XWWR-4H3P-R22C rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...
rclone: S3 multipart declared-length memory exhaustion
Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...
CVE-2026-88044
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...
CVE-2026-88045
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...
CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...
CVE-2026-88018
rclone (a command-line tool for syncing files to cloud storage) contains a SigV4 signature bypass in its serve s3 mode. When configured with --auth-proxy but without --auth-key, the authPairMiddleware registers any client-chosen accessKeyID with an empty secret. The embedded gofakes3 component th...
CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
CVE-2026-88018
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS)
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...
PT-2026-89704
Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...
PT-2026-89489
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...
PT-2026-89695
Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...
PT-2026-89681
Summary In streamed multipart mode, serve s3 passes the request's declared part length to multipart.NewRW.ReservecontentLength before reading any part data. Reserve immediately obtains enough 1 MiB pool pages for the entire declared length. The request handler therefore allocates attacker-selecte...
CVE-2026-47668
CVE-2026-47668 — Ejecución Remota de Código en DbGate RCE no autenticado en el ejecutor de scripts JSON de DbGate dbgate-serve ≤ 7.1.8. Herramienta de evaluación: CVE-2026-47668.py — solo para pruebas autorizadas...