CVE-2026-70459: rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
Other sources
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70459?
The severity of CVE-2026-70459 is classified as medium with a score of 5.3.
How do I fix CVE-2026-70459?
To fix CVE-2026-70459, upgrade rsync to version 3.5.0 or later.
What does CVE-2026-70459 affect?
CVE-2026-70459 affects rsync versions prior to 3.5.0.
What kind of vulnerability is CVE-2026-70459?
CVE-2026-70459 is a null pointer dereference vulnerability.
What is the impact of exploiting CVE-2026-70459?
Exploiting CVE-2026-70459 can cause the rsync daemon to crash.