rsync Daemon Connection Slot Exhaustion via Handshake Stalling

Executive Summary

CVE-2026-70464 is a denial-of-service (DoS) vulnerability in rsync versions 2.0.0 through 3.4.4. It allows unauthenticated remote attackers to exhaust connection slots by stalling the handshake process before or after module selection. Attackers can either trickle data slowly to avoid timeouts or stall entirely before module selection where no timeout applies. This consumes all available slots, denying legitimate users access to the rsync daemon.

Useful 0 Not Useful 0

Detection Guidance

Monitor rsync daemon connections for unusual activity such as multiple stalled handshakes or connections consuming slots without data transfer. Check logs for connections that remain open indefinitely or show minimal data trickling. Use netstat or ss commands to inspect active connections to the rsync port (typically 873).

Commands to detect: netstat -tulnp | grep rsync or ss -tulnp | grep rsync. Look for many connections in ESTABLISHED state with no data transfer or very slow rates.

Useful 0 Not Useful 0

Impact Analysis

If you run an rsync daemon using versions 2.0.0 to 3.4.4, an attacker could make your service unavailable by consuming all connection slots. This would prevent legitimate users from accessing your rsync server, disrupting file transfers and backups. The impact is limited to availability and does not involve data theft or modification.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability, which could lead to non-compliance with regulations requiring timely data access or backup capabilities, such as HIPAA for healthcare data or GDPR for data processing timelines. Downtime due to DoS may violate service level agreements or regulatory requirements for data accessibility.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later to address the vulnerability. If upgrading is not immediately possible, disable the rsync daemon or restrict access via firewall rules to trusted IPs only.

Set a non-zero timeout for the handshake process in rsync configuration if supported. Monitor and limit the maximum number of connections to prevent exhaustion.

Useful 0 Not Useful 0