CVE-2026-70462
MediumCVSS 6.5Summary
rsync versions 3.1.0 through before 3.5.0 contain a signed integer overflow vulnerability in the I/O timeout implementation. Attackers can inject MSG_IO_TIMEOUT messages with non-positive values, causing the timeout variable to wrap and permanently disabling connection timeouts, allowing idle connections to hold daemon slots indefinitely and leading to resource exhaustion.
Risk Assessment
An attacker can block rsync daemon slots, leading to resource exhaustion and denial of service.
Recommendation
Update rsync to version 3.5.0 or later.
Original NVD description (English source)
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.