CVE-2026-70455: rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
Other sources
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70455?
CVE-2026-70455 has a high severity rating of 7.5.
How do I fix CVE-2026-70455?
To fix CVE-2026-70455, upgrade rsync to version 3.5.0 or later.
What impact does CVE-2026-70455 have on affected systems?
CVE-2026-70455 allows a denial of service attack that can exhaust system resources.
Which versions of rsync are affected by CVE-2026-70455?
Rsync versions 3.4.2 and earlier are affected by CVE-2026-70455.
How does CVE-2026-70455 exploit the rsync command?
CVE-2026-70455 exploits rsync by allowing an attacker to specify the --zt option to bypass certain security restrictions.