CVE-2026-70455 in Rsync
Summary
by MITRE • 08/13/2026
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in rsync versions prior to 3.5.0 represents a critical denial of service weakness that exploits a design oversight in option parsing and resource management. This flaw specifically targets the compression threading mechanism through the --zt short alias for --compress-threads, creating a pathway for remote attackers to manipulate system resources regardless of security configurations. The vulnerability stems from an insufficient validation mechanism that fails to properly restrict the number of worker threads spawned during compression operations, allowing malicious actors to specify arbitrary thread counts that can overwhelm system capabilities.
The technical execution of this vulnerability relies on the bypass of existing security controls designed to prevent excessive resource consumption through the refuse options directive. This directive typically prevents long option names from being used in contexts where they might cause harm, but the --zt alias circumvents these protections entirely. When an attacker sends a command with --zt=N where N is a large numerical value, the rsync receiver process creates an unbounded number of Zstandard worker threads that consume both CPU time and memory resources without proper limits. The underlying architecture fails to enforce reasonable bounds on thread creation, leading to rapid resource exhaustion that can render the system unusable.
From an operational perspective, this vulnerability presents a significant threat to systems running rsync services as it allows remote attackers to cause system instability through simple network requests. The impact extends beyond immediate service disruption to potentially affect other applications sharing system resources, as excessive thread creation can lead to complete system lockups or crashes. This type of resource exhaustion attack aligns with common attack patterns documented in the attack framework, particularly those involving process and memory manipulation techniques that target service availability.
The vulnerability demonstrates weaknesses in input validation and resource management practices that are commonly addressed through established security frameworks. It relates to CWE-770, which covers allocation of resources without limits or throttling, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. The flaw also represents poor implementation of the principle of least privilege in resource management, where system resources are not appropriately constrained despite the presence of security controls designed to prevent such abuses.
Mitigation strategies should focus on immediate version upgrades to rsync 3.5.0 or later, which include proper bounds checking for compression threads and enhanced option validation. System administrators should implement additional monitoring for unusual thread creation patterns and consider implementing resource limits through operating system controls like ulimit settings. Network-level protections such as firewall rules that restrict rsync access to trusted sources can provide additional defense layers. Organizations should also review their existing security policies to ensure proper handling of command-line options and implement comprehensive testing procedures for option parsing behaviors to prevent similar bypass vulnerabilities in other software components.