CVE-2026-70452: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
Other sources
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0Patch rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70452?
The severity of CVE-2026-70452 is high, rated at 7.4.
How do I fix CVE-2026-70452?
To fix CVE-2026-70452, upgrade rsync to version 3.5.0 or later.
What does CVE-2026-70452 affect?
CVE-2026-70452 affects rsync versions prior to 3.5.0.
What is the impact of CVE-2026-70452?
CVE-2026-70452 allows remote attackers to bypass access control rules by inducing DNS resolution failures.
Who is vulnerable to CVE-2026-70452?
Users running rsync version 3.1.0 before 3.5.0 are vulnerable to CVE-2026-70452.