CVE-2026-70464 in rsync
Summary
by MITRE • 08/13/2026
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The rsync daemon vulnerability represents a critical denial of service weakness that has persisted across multiple versions of the software ecosystem. This flaw resides in the daemon's connection handling mechanism where attackers can exploit the protocol's handshake process to consume available connection slots without triggering standard timeout mechanisms. The vulnerability affects rsync daemon versions prior to 3.5.0 and specifically targets the connection slot exhaustion pattern that occurs during the pre-module selection phase of the protocol negotiation.
The technical implementation of this vulnerability stems from insufficient connection state management within the rsync daemon process. When an attacker establishes a connection to the daemon, they can deliberately stall the handshake process either before or after module selection. During these stalled states, the daemon maintains connection slots in a limbo state where standard I/O timeouts do not apply, allowing attackers to occupy resources indefinitely. The protocol's design fails to properly enforce connection rate limiting or implement proper connection lifecycle management that would prevent such resource exhaustion attacks.
From an operational perspective, this vulnerability creates significant disruption for legitimate users and systems relying on rsync services. Attackers can open numerous simultaneous connections while transmitting data at minimal rates, effectively consuming all available daemon connection slots. This approach prevents new legitimate clients from establishing connections to the service, creating a complete denial of service condition that impacts system availability. The attack methodology is particularly effective because it exploits the protocol's inherent design rather than requiring exploitation of specific code vulnerabilities or memory corruption issues.
The vulnerability aligns with several cybersecurity frameworks and threat modeling approaches, including CWE-400 which addresses uncontrolled resource consumption, and ATT&CK technique T1498 which covers denial of service attacks. The attack pattern demonstrates characteristics of resource exhaustion attacks that target protocol implementation weaknesses rather than application-level flaws. Organizations using rsync daemon services face potential operational impacts ranging from temporary service disruption to complete availability loss depending on the scale of the attack and available connection capacity.
Mitigation strategies should prioritize immediate software updates to rsync versions 3.5.0 or later where the vulnerability has been addressed through improved connection handling and timeout management. System administrators should implement connection rate limiting at network boundaries and configure proper daemon resource limits to prevent single attackers from consuming all available slots. Additional protective measures include implementing firewall rules that limit concurrent connections per source IP address, monitoring connection patterns for unusual behavior, and configuring daemon parameters to enforce stricter connection timeouts. The solution requires a multi-layered approach that addresses both the immediate protocol-level weakness and broader system security posture considerations.