CVE-2026-70455

A denial-of-service flaw in rsync allows remote attackers to exhaust system memory and CPU. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads.

This Important rsync denial-of-service vulnerability allows remote, unauthenticated attackers to exhaust server resources. By using the --zt alias for Zstandard compression, attackers can bypass refuse options to spawn unlimited worker threads and disrupt the service. RHEL 9 and older versions are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the rsync daemon is unused, immediately disable rsyncd.service to eliminate the attack surface. For active deployments, restrict network access (TCP 873) strictly to trusted hosts using firewall rules. Do not rely on refuse options = compress-threads for protection, as the --zt alias bypasses this configuration. Network isolation is the most effective defense.