CVE-2026-79777
Fixed in a distro release EPSS <1%CVSS 2.7
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Products: rclone
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/rclone/rclone | 1.75.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | rclone | 1.75.1-1.amzn2023 |
| Debian 12 | rclone | no fix |
| Debian 13 | rclone | no fix |
| Ubuntu 18.04 LTS | rclone | no fix |
| Ubuntu 26.10 | rclone | no fix |
| Ubuntu Pro 20.04 LTS | rclone | no fix |
| Ubuntu Pro 22.04 LTS | rclone | no fix |
| Ubuntu Pro 24.04 LTS | rclone | no fix |
| Ubuntu Pro 26.04 LTS | rclone | no fix |