CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m
https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) El demonio rsync 2.0.0 anterior a 3.5.0 contiene una vulnerabilidad de denegación de servicio que permite a atacantes remotos no autenticados agotar las ranuras de conexión del demonio al estancar el proceso de handshake antes o después de la selección de módulos sin activar el tiempo de espera de E/S. Los atacantes pueden abrir muchas conexiones simultáneas y enviar datos a la velocidad mínima para evitar el tiempo de espera, o estancarse completamente antes de la selección de módulos donde no se aplica ningún tiempo de espera, consumiendo todas las ranuras de conexión disponibles y denegando el servicio a clientes legítimos.

Information

Published : 2026-08-13 15:20

Updated : 2026-10-24 15:10

NVD link : CVE-2026-70464

Mitre link : CVE-2026-70464

CVE.ORG link : CVE-2026-70464

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-70464", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70464", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T15:51:09.213016Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RsyncProject/rsync", "vendor": "RsyncProject", "product": "rsync", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "3.4.4"}, {"status": "unaffected", "version": "3.5.0", "versionType": "semver"}], "packageURL": "pkg:github/RsyncProject/rsync", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T15:20:01.667", "references": [{"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "rsync daemon 2.0.0 before 3.5.0\u00a0contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients."}, {"lang": "es", "value": "El demonio rsync 2.0.0 anterior a 3.5.0 contiene una vulnerabilidad de denegaci\u00f3n de servicio que permite a atacantes remotos no autenticados agotar las ranuras de conexi\u00f3n del demonio al estancar el proceso de handshake antes o despu\u00e9s de la selecci\u00f3n de m\u00f3dulos sin activar el tiempo de espera de E/S. Los atacantes pueden abrir muchas conexiones simult\u00e1neas y enviar datos a la velocidad m\u00ednima para evitar el tiempo de espera, o estancarse completamente antes de la selecci\u00f3n de m\u00f3dulos donde no se aplica ning\u00fan tiempo de espera, consumiendo todas las ranuras de conexi\u00f3n disponibles y denegando el servicio a clientes leg\u00edtimos."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}