CVE-2026-70459

A flaw was found in rsync. A remote attacker could send a specially crafted file list to the rsync daemon. This could lead to a null pointer dereference, causing the daemon to crash and resulting in a Denial of Service (DoS).

This Moderate impact vulnerability in rsync allows a remote, unauthenticated attacker to trigger a null pointer dereference in the rsync daemon by sending a specially crafted file list. This can lead to a denial of service, as the daemon will crash and terminate the client connection. The impact is limited to availability and requires the rsync daemon to be actively running and exposed to untrusted networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the rsync daemon to trusted clients only. If the rsync daemon is not actively used, consider disabling the service.

To restrict access using firewall-cmd: firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_ADDRESS>" port port="873" protocol="tcp" accept' firewall-cmd --reload

To disable the rsync service: systemctl stop rsyncd.service systemctl disable rsyncd.service If the rsync service is re-enabled or reloaded, the mitigation steps may need to be reapplied.