CVE-2026-70464
published 2026-08-13CVE-2026-70464: rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.57%
45.2th percentile
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rsyncproject | rsync | 2.0.0 – 3.4.4 | — |
| samba | rsync | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-70464 rsync-bpc: rsync: Denial of Service via handshake stall [epel-all]
bugzilla·2026-08-24·CVSS 7.5
CVE-2026-70464 [HIGH] CVE-2026-70464 rsync-bpc: rsync: Denial of Service via handshake stall [epel-all]
CVE-2026-70464 rsync-bpc: rsync: Denial of Service via handshake stall [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service t
Bugzilla
CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall [fedora-all]
bugzilla·2026-08-24·CVSS 7.5
CVE-2026-70464 [HIGH] CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall [fedora-all]
CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to
Bugzilla
CVE-2026-70464 rsync-bpc: rsync: Denial of Service via handshake stall [fedora-all]
bugzilla·2026-08-24·CVSS 7.5
CVE-2026-70464 [HIGH] CVE-2026-70464 rsync-bpc: rsync: Denial of Service via handshake stall [fedora-all]
CVE-2026-70464 rsync-bpc: rsync: Denial of Service via handshake stall [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service
Bugzilla
CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall
bugzilla·2026-08-13·CVSS 7.5
CVE-2026-70464 [HIGH] CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall
CVE-2026-70464 rsync: rsync: Denial of Service via handshake stall
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.
2026-08-13
Published