CVE-2026-70462

A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to resource exhaustion, preventing legitimate users from accessing the rsync service and resulting in a denial of service.

This is a Moderate denial of service flaw in rsync, where a remote, unauthenticated attacker can exhaust system resources. By injecting specially crafted messages, an attacker can disable connection timeouts, causing rsync daemon connections to remain active indefinitely. This can lead to resource exhaustion, preventing legitimate users from accessing the rsync service. The impact is limited to denial of service and does not allow for arbitrary code execution or data compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Only run rsync against trusted remotes. Restrict which hosts local rsync and rsync-bpc may reach. A peer MSG_IO_TIMEOUT can disable or overflow the client’s --timeout; daemon hosts allow does not bind this.