backends

  GO-2026-6456: rclone: S3 multipart declared-length memory exhaustion in github.com/rclone/rclone

  GO-2026-6457: rclone: source object names can escape the configured root on upload in github.com/rclone/rclone

  GO-2026-6458: rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone

  GO-2026-6459: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone

  GO-2026-6460: rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone

  GO-2026-6461: rclone local: crafted Range request against a translated symlink panics (DoS) in github.com/rclone/rclone

  GO-2026-6462: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

  GO-2026-6463: rclone: http backend forwards custom/auth headers to a different host on redirect in github.com/rclone/rclone

  GO-2026-6464: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace in github.com/rclone/rclone