CVE-2026-70462 in Rsync
Summary
by MITRE • 08/13/2026
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability under discussion represents a critical signed integer overflow flaw within rsync version 3.1.0 through 3.4.9, specifically impacting the input/output timeout mechanism. This issue stems from improper validation of timeout values during message processing, creating a condition where attackers can manipulate timeout parameters to disable connection timeouts entirely. The flaw resides in how the system handles MSG_IO_TIMEOUT messages, which are designed to manage connection idle periods and prevent resource exhaustion through automatic disconnection of inactive sessions.
The technical implementation of this vulnerability exploits the fundamental weakness in integer arithmetic handling within rsync's timeout processing code. When a malicious MSG_IO_TIMEOUT message is crafted with non-positive values, the signed integer overflow occurs during arithmetic operations that normally validate timeout intervals. This overflow causes the timeout variable to wrap around to a positive value that bypasses all timeout checks, effectively rendering the daemon's connection management ineffective. The vulnerability specifically affects the timeout calculation logic where negative or zero values are not properly sanitized before being processed in arithmetic operations that determine whether connections should be terminated.
This flaw creates significant operational impact by enabling persistent resource exhaustion attacks against rsync daemons. Once exploited, attackers can maintain indefinitely long connections that consume daemon slots and system resources without triggering automatic cleanup mechanisms. The vulnerability allows for sustained denial of service conditions where legitimate users cannot establish new connections due to exhausted daemon capacity. The persistent nature of these connections means that even after the initial attack, the resource exhaustion continues until manual intervention or daemon restart occurs, making it particularly dangerous in production environments.
The attack vector leverages the protocol's message handling capabilities to inject malicious timeout values that bypass validation checks. This requires attackers to have access to the rsync protocol interface and the ability to send specially crafted messages, which typically means either direct network access to the service or exploitation of other vulnerabilities that provide message injection capabilities. The vulnerability aligns with CWE-190, which covers signed integer overflow conditions, and represents a classic example of how arithmetic overflows can lead to security issues in network services. From an ATT&CK perspective, this vulnerability maps to T1499.004 for network denial of service and T1566.002 for social engineering through protocol manipulation.
Mitigation strategies should focus on implementing proper input validation and integer overflow protection mechanisms within rsync's timeout handling code. The most effective approach involves adding explicit bounds checking for timeout values before any arithmetic operations are performed, ensuring that negative or zero values are rejected or converted to valid positive intervals. Additionally, implementing comprehensive timeout value sanitization and utilizing unsigned integer types where appropriate can prevent the wraparound conditions that enable this attack. System administrators should also consider implementing connection limits and monitoring mechanisms to detect unusual connection patterns that might indicate exploitation attempts. Updates to rsync versions 3.5.0 and later contain patches addressing this specific vulnerability through improved timeout validation and overflow protection measures.
The broader implications of this vulnerability highlight the importance of robust input validation in network services and the potential for seemingly benign protocol features to become attack vectors when proper boundary checking is absent. This flaw demonstrates how integer overflows can be weaponized in network protocols to create persistent denial of service conditions, emphasizing the need for comprehensive security testing that includes edge case scenarios and malicious input handling. Organizations should implement regular security assessments of their network services to identify similar vulnerabilities in integer arithmetic handling and ensure appropriate defensive measures are in place to prevent exploitation through crafted protocol messages.