PT-2026-71655

CVE-2026-70455

Published

2026-08-13

Updated

2026-10-05

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions rsync versions 3.4.2 through 3.4.x

Description A denial of service issue exists where a remote sender can exhaust system resources on the receiver. This occurs because the short alias --zt for the --compress-threads option bypasses the string matching of the refuse options directive, which only checks long option names. An attacker can provide a large value for the --zt variable to spawn an unbounded number of Zstandard worker threads, leading to the exhaustion of available memory and thread resources.

Recommendations Update rsync to version 3.5.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Fcasal

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers