CVE-2026-70452

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x

Description An access control bypass exists that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule instead of defaulting to a deny decision. This allows attackers to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

Recommendations Update rsync to version 3.5.0 or later.