rclone <= 1.74.0: Nil-Response Panic in Infinite Scale TUS Creation
- Severity
- HIGH
- Affected component
- rclone (go)
- Affected versions
- <= 1.74.0
- Patched version
- Not yet available
An early warning has been issued for rclone <= 1.74.0. A transport failure during the initial Infinite Scale TUS creation POST can cause a nil-response panic.
What happened
An early warning has been issued for rclone <= 1.74.0. A transport failure during the initial Infinite Scale TUS creation POST can return a nil response and a non-nil error. Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint.
This issue is under investigation. It is recommended to monitor for panics in long-lived or multi-workload processes using rclone. Consider mitigating by handling pre-response transport failures gracefully.
What to do about it
- Monitor for panics in long-lived or multi-workload processes using rclone.
- Consider mitigating by handling pre-response transport failures gracefully.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using rclone version 1.74.0 or earlier.
What should I do right now?
Monitor for panics in long-lived or multi-workload processes using rclone. Consider mitigating by handling pre-response transport failures gracefully.
Is there an official fix available?
No official fix has been published yet. Monitor the sources below for updates.