GHSA-3x6r-wxxg-53vv: rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic
A transport failure during the initial Infinite Scale TUS creation POST can return (nil response, non-nil error). Rclone dereferences the nil response before processing the error and panics. The production CreateUploader path reproduced the crash against a closed endpoint.
The security case is deployment-dependent. A one-shot upload already fails when its endpoint resets, while RC jobs recover panics in fs/rc/jobs/job.go and return a job error. The incremental denial of service is strongest in a long-lived VFS mount or concurrent/multi-remote CLI process where the upload runs in an unrecovered goroutine and the panic terminates unrelated work.
References
Code Behaviors & Features
Detect and mitigate GHSA-3x6r-wxxg-53vv with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →