CVE-2026-70462: rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSGIOTIMEOUT
Other sources
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSGIOTIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.0-1 - Upgrade
Upgrade
alpine/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0-r0 - Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1 - Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-1 - Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1Fixed in 3.5.1+ds1-2Fixed in 3.5.2+ds1-1 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Compensating control
Until rsync is upgraded, prevent attackers from being able to send MSG_IO_TIMEOUT messages to rsync (e.g., restrict network access to the rsync service to trusted sources / trusted networks using firewall or ACLs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70462?
CVE-2026-70462 has a medium severity rating of 6.5.
How do I fix CVE-2026-70462?
To fix CVE-2026-70462, upgrade to rsync version 3.5.0 or later.
What kind of vulnerability is CVE-2026-70462?
CVE-2026-70462 is a signed integer overflow vulnerability.
What software is affected by CVE-2026-70462?
The vulnerability affects rsync versions before 3.5.0.
What impact does CVE-2026-70462 have on the system?
CVE-2026-70462 allows attackers to disable connection timeouts, potentially leading to system unresponsiveness.