CVE-2026-70453 in rsync
Summary
by MITRE • 08/13/2026
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in rsync versions prior to 3.5.0 represents a critical algorithmic complexity issue that fundamentally undermines the protocol's performance characteristics and resource management capabilities. This weakness resides within the hash_search() function where the implementation exhibits quadratic time complexity behavior under specific conditions, creating an exploitable path for remote attackers to manipulate system resources through carefully crafted file list inputs.
The technical flaw manifests when an attacker constructs a malicious file list that triggers the worst-case scenario of the hash lookup algorithm, causing the receiver system to experience exponentially increasing computational overhead. The hash_search() function fails to maintain consistent performance characteristics under adversarial input patterns, leading to a situation where CPU resources are consumed at a rate that scales quadratically with the number of entries in the crafted file list. This behavior directly violates fundamental principles of algorithmic efficiency and resource prediction that network protocols must maintain to ensure predictable system behavior.
The operational impact of this vulnerability extends beyond simple service disruption to encompass sustained resource exhaustion attacks that can persistently degrade system performance. Attackers can leverage this weakness to consume substantial CPU cycles on the target rsync receiver with relatively small input sizes, making the attack both efficient and effective from an adversary perspective. The sustained nature of the denial of service means that legitimate users may experience prolonged periods of reduced service availability or complete unresponsiveness of the rsync daemon.
This vulnerability aligns with CWE-798 and CWE-400 categories that specifically address algorithmic complexity issues and resource exhaustion attacks within network protocols. From an ATT&CK framework perspective, this represents a privilege escalation and denial of service technique that can be executed remotely without requiring authentication, making it particularly dangerous in environments where rsync services are exposed to untrusted networks. The attack vector follows the pattern of resource exhaustion techniques commonly used in DoS attacks against network services.
Mitigation strategies should prioritize immediate patching to rsync version 3.5.0 or later, which contains the corrected hash_search() implementation that eliminates the quadratic behavior. Organizations should also implement rate limiting and input validation mechanisms on rsync receivers to detect and prevent unusually large file list constructions. Network segmentation and access control measures can provide additional defense in depth by limiting exposure of rsync services to potentially malicious actors. The fix addresses the core algorithmic issue through improved hash table management that maintains consistent O(1) lookup performance regardless of input patterns, thereby preventing the exploitation path entirely.