CVE-2026-70459

Name of the Vulnerable Software and Affected Versions rsync versions 3.0.0 through 3.4.x

Description A null pointer dereference occurs in the daemon child process. A remote attacker can cause the daemon to crash by sending a file list where the first entry is a dot entry not typed as a directory. The daemon processes the first file list entry as a directory structure pointer without verifying the entry type, leading to an invalid or uninitialized pointer dereference that terminates the client connection.

Recommendations Update rsync to version 3.5.0 or later.