CVE-2026-70464 rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall
Unauthenticated attackers can exhaust rsync daemon connection slots by stalling handshakes, causing denial of service for legitimate clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70464?
CVE-2026-70464 is a high-severity denial of service vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.
Weakness: CWE-770
Which versions are affected by CVE-2026-70464?
How do I fix CVE-2026-70464?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-70464 being exploited?
There is no known exploitation of CVE-2026-70464 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-70464, AZL-95792, BELL-CVE-2026-70464, DEBIAN-CVE-2026-70464, ECHO-3879-0d40-e19e, GHSA-hrwq-ccf7-rw5m and 2 more.