CVE-2026-70455

Analyzed Analyzed - Analysis Complete

rsync Denial of Service via --zt Option Exhaustion

Publication date: 2026-08-13

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-31

Generated

2026-09-03

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-02

NVD

CVE-2026-70455

EUVD

EUVD-2026-58049

Affected Vendors & Products

Vendor	Product	Version / Range
samba	rsync	From 3.4.2 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is a denial-of-service vulnerability in rsync versions 3.4.2 through 3.4.4. A remote attacker can exploit the --zt short alias for --compress-threads to spawn an excessive number of Zstandard worker threads on the receiver by specifying a large value like --zt=N. This bypasses refuse options directives that block long option names, exhausting system resources such as threads and memory.

Detection Guidance

Check rsync version with 'rsync --version' to confirm if it is 3.4.2 through 3.4.4. Monitor for unusual high thread counts or memory usage during rsync operations, especially with --zt or --compress-threads flags. Use 'ps aux | grep rsync' to inspect running processes for excessive worker threads.

Impact Analysis

The vulnerability allows attackers to crash or severely degrade the performance of rsync servers by consuming all available threads and memory. This can disrupt legitimate services running on the affected machine, leading to downtime or degraded functionality for other processes.

Compliance Impact

This vulnerability primarily impacts system availability by enabling denial-of-service attacks through resource exhaustion. While it does not directly violate GDPR or HIPAA, it could lead to non-compliance if it causes service disruptions affecting data processing or availability of critical systems. Organizations must ensure rsync is updated to mitigate risks to system reliability.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, restrict access to rsync daemon ports via firewall rules and disable anonymous modules. Monitor system resources closely for signs of resource exhaustion.

Hi! I’m here to help you understand CVE-2026-70455. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70