CVE-2026-70462

MEDIUM 6.5

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

CWE	CWE-190 CWE-835
Vendor	rsyncproject
Product	rsync
Published	Aug 13, 2026
Last Updated	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for rsyncproject rsync

Be the first to know when new medium vulnerabilities affecting rsyncproject rsync are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

RsyncProject / rsync

3.1.0 ≤ 3.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64 github.com: https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 vulncheck.com: https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout

Credits

z3r0s6 buger