CVE-2026-71310

CVE-2026-71310 in rclone exposes a pre-authentication attack vector in SFTP that bypasses the protocol's primary defense mechanism. When rclone connects to an SFTP server through an HTTP proxy, it reaches the CONNECT parser before validating the SSH server's host key. This means an attacker who controls or sits on the path to the configured proxy can trigger memory exhaustion in the CONNECT response handling — without ever needing to present a valid SSH host key. The vulnerability lives in lib/proxy/http.go, where the HTTP CONNECT handling is shared between protocols with fundamentally different trust models. FTP's proxy model assumes anonymous or untrusted forward connections; SFTP assumes the server's host key is validated before any substantive data exchange. rclone composed these two models by sharing a low-level transport helper that operates outside both security perimeters. The memory exhaustion is the symptom — the deeper issue is that SFTP's authentication gate is evaluated after the proxy connection completes, inverting the trust hierarchy the protocol expects. Version 1.75.0 patches this with bounds checking on the CONNECT response parser. Update immediately. Beyond the patch, audit your rclone configurations: if you use an HTTP proxy for SFTP connections, that proxy is now a critical trust boundary. A compromised or malicious proxy in your configuration gives an attacker pre-authentication access to trigger this DoS. The EPSS score (0.00373) reflects low short-term exploitation probability, but this assumes the proxy is benign — if your threat model includes an adversarial proxy (insider, supply chain compromise, or on-path attacker), the actual risk is higher than the score suggests. The architectural question this CVE raises: what other shared transport components in rclone's proxy layer serve protocols with mismatched security assumptions? The fix addresses this instance, but the pattern of sharing infrastructure between weak-context and strong-context protocols is worth auditing across the codebase.

Reviewed through automated stages and approved by a human before publication.