CVE-2026-70453
Received Received - Intake

Denial of Service in rsync via Hash Collision Attack

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-70453
EUVD
EUVD-2026-58051

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
rsync_project rsync to 3.5.0 (exc)
rsync_project rsync 3.4.4
rsync rsync to 3.5.0 (exc)
rsync rsync to 3.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects rsync versions 3.4.4 and earlier. It allows a remote attacker to cause a denial of service by sending a crafted file list that triggers quadratic CPU exhaustion in the hash_search() function. The attack exploits inefficient algorithmic complexity in hash lookups, specifically a long chain of equal weak checksums, causing sustained high CPU usage.

Detection Guidance

Check rsync version with 'rsync --version' to see if it is 3.4.4 or earlier. Monitor CPU usage during rsync transfers for unexpected spikes. Inspect network traffic for large file lists with repeated weak checksums.

Impact Analysis

If exploited, this vulnerability can exhaust CPU resources on the rsync receiver, leading to a denial of service. This impacts shared host resources beyond the attacker's transfer, potentially slowing down or crashing systems relying on rsync for file synchronization.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable rsync services if not essential. Restrict network access to rsync ports via firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart