Vulnerability Description
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Rsync | >= 3.4.2, < 3.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0ProductRelease Notes
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9Vendor Advisory
- https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-threRelease NotesThird Party Advisory
FAQ
What is CVE-2026-70455?
CVE-2026-70455 is a vulnerability with a CVSS score of 7.5 (HIGH). rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses th...
How severe is CVE-2026-70455?
CVE-2026-70455 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-70455?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Rsync.