CVE-2026-70462 rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
Attackers can cause resource exhaustion in rsync daemons by sending crafted messages that disable connection timeouts, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-70462?
CVE-2026-70462 is a high-severity vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
Which versions are affected by CVE-2026-70462?
How do I fix CVE-2026-70462?
Upgrade to a fixed version.
Is CVE-2026-70462 being exploited?
There is no known exploitation of CVE-2026-70462 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-70462, AZL-95840, BELL-CVE-2026-70462, DEBIAN-CVE-2026-70462, ECHO-255d-4439-03d3, GHSA-j9wh-5jmp-2m64 and 2 more.