CVE-2026-70464

A denial of service flaw was found in the rsync daemon. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection slots, preventing legitimate clients from connecting.

An unauthenticated remote attacker can exhaust available connection slots by stalling the handshake process, preventing legitimate clients from connecting. This vulnerability primarily affects systems where the rsync daemon is explicitly enabled and exposed to untrusted networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the rsync daemon if unused (systemctl disable --now rsyncd), or strictly restrict TCP/873 access to trusted clients using firewall rules and hosts allow directives. Do not rely on standard module timeout settings, as they do not protect against this specific pre-handshake stall. While configuring system limits (TasksMax/LimitNOFILE) can prevent full host resource exhaustion, aggressive IP-based connection filtering is the only reliable way to keep the targeted rsync module available.