CVE-2026-70455: rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70455?
CVE-2026-70455 has a high severity rating of 7.5.
How do I fix CVE-2026-70455?
To fix CVE-2026-70455, upgrade rsync to version 3.5.0 or later.
What impact does CVE-2026-70455 have on affected systems?
CVE-2026-70455 allows a denial of service attack that can exhaust system resources.
Which versions of rsync are affected by CVE-2026-70455?
Rsync versions 3.4.2 and earlier are affected by CVE-2026-70455.
How does CVE-2026-70455 exploit the rsync command?
CVE-2026-70455 exploits rsync by allowing an attacker to specify the --zt option to bypass certain security restrictions.