CVE-2026-70453

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description An algorithmic complexity issue exists in the hash search() function. A remote attacker can trigger a denial of service by sending a carefully constructed file list. This exploit leverages quadratic-time worst-case behavior during hash lookups to exhaust the receiver's CPU resources using a small number of crafted entries, resulting in a sustained denial of service.

Recommendations Update rsync to version 3.5.0 or later.