CVE-2026-70462: rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSGIOTIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Compensating control
Until rsync is upgraded, prevent attackers from being able to send MSG_IO_TIMEOUT messages to rsync (e.g., restrict network access to the rsync service to trusted sources / trusted networks using firewall or ACLs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70462?
CVE-2026-70462 has a medium severity rating of 6.5.
How do I fix CVE-2026-70462?
To fix CVE-2026-70462, upgrade to rsync version 3.5.0 or later.
What kind of vulnerability is CVE-2026-70462?
CVE-2026-70462 is a signed integer overflow vulnerability.
What software is affected by CVE-2026-70462?
The vulnerability affects rsync versions before 3.5.0.
What impact does CVE-2026-70462 have on the system?
CVE-2026-70462 allows attackers to disable connection timeouts, potentially leading to system unresponsiveness.