NULL Pointer Dereference Affecting github.com/rclone/rclone/backend/webdav package, versions <1.75.0

Affected versions of this package are vulnerable to NULL Pointer Dereference in the getTusLocationOrRetry function when a transport failure occurs during the initial Infinite Scale TUS creation POST, resulting in a nil HTTP response that is dereferenced before error handling. An attacker can cause the process to panic and terminate unrelated work by configuring a malicious or compromised endpoint that resets the connection during a long-lived or concurrent upload process. This is only exploitable if uploads are performed in an unrecovered goroutine, such as in a long-lived VFS mount or multi-remote CLI process.

• GitHub Advisory
• GitHub Commit
• GitHub Release