CVE-2026-70459: rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70459?
The severity of CVE-2026-70459 is classified as medium with a score of 5.3.
How do I fix CVE-2026-70459?
To fix CVE-2026-70459, upgrade rsync to version 3.5.0 or later.
What does CVE-2026-70459 affect?
CVE-2026-70459 affects rsync versions prior to 3.5.0.
What kind of vulnerability is CVE-2026-70459?
CVE-2026-70459 is a null pointer dereference vulnerability.
What is the impact of exploiting CVE-2026-70459?
Exploiting CVE-2026-70459 can cause the rsync daemon to crash.