—

GO-2026-6183

Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

Quick fix

GO-2026-6183 — github.com/rclone/rclone: upgrade to the fixed version with the command below.

go get github.com/rclone/rclone@v1.75.0

Details

During WebDAV Infinite Scale TUS upload creation, a transport failure can return a nil HTTP response along with an error. When handling the failure, rclone dereferences the nil response before checking the error, causing a panic that can crash the process in unrecovered contexts such as VFS mounts.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/rclone/rclone

Introduced in: 0 Fixed in: 1.75.0

Fix go get github.com/rclone/rclone@v1.75.0

References

https://github.com/rclone/rclone/security/advisories/GHSA-3x6r-wxxg-53vv [ADVISORY]
https://github.com/rclone/rclone/commit/5871d98c368751a6d992ed64f8cd22cb78c44cee [FIX]
https://github.com/rclone/rclone/releases/tag/v1.75.0 [WEB]