CVE-2026-70462: 
rsync vulnerability analysis and mitigation

CVE-2026-70462 is a signed integer overflow vulnerability in rsync's I/O timeout implementation, allowing attackers to permanently disable connection timeouts by injecting crafted MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. It affects rsync versions 3.1.0 through 3.4.4 (the MSG_IO_TIMEOUT message type was introduced in 3.1.0) and is fixed in version 3.5.0. The vulnerability was published on August 13, 2026, and was reported by researchers z3r0s6 and Leonid Bugaev (buger). It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is a signed integer overflow (CWE-190) in rsync's timeout arithmetic when processing peer-supplied MSG_IO_TIMEOUT values, which can result in an infinite loop condition (CWE-835). A malicious peer sends an MSG_IO_TIMEOUT value that the receiving client folds into its own timeout calculation; the multiplication overflows a signed integer, producing undefined behavior — depending on compiler settings, the result can be a negative poll timeout (meaning "wait forever"), a spin loop, or a flood of keepalives. A secondary defect, pre-existing since 2009, allowed a non-positive value to be accepted outright, disabling the receiver's I/O timeout entirely without triggering an overflow. The vulnerability is exploitable only by the connecting client role (server and generator roles reject MSG_IO_TIMEOUT), which is why user interaction is required (AV:N/PR:N/UI:R). The fix caps the peer-supplied value on receipt and makes set_io_timeout() arithmetic overflow-safe (GitHub Advisory).

Successful exploitation results in a denial-of-service condition: idle or stalled connections hold rsync daemon slots indefinitely, exhausting available connection slots and preventing legitimate clients from connecting. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. In environments where rsync daemons serve critical backup or file synchronization workloads, sustained exploitation could disrupt operations across all dependent systems (GitHub Advisory, Feedly).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.0026 (0.26%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the technical impact as "partial" (GitHub Advisory, VulnCheck).

1. Set up a malicious rsync server: Configure a rogue rsync server that the victim client will connect to, either via social engineering, DNS poisoning, or a man-in-the-middle position on the network.
2. Wait for client connection: The vulnerability is exploitable only against the connecting client role; the attacker must induce a victim rsync client (version 3.1.0–3.4.4) to connect to the malicious server.
3. Inject crafted MSG_IO_TIMEOUT message: During the rsync protocol handshake, send a MSG_IO_TIMEOUT message carrying a non-positive value (zero or negative) or a very large value designed to overflow the signed integer in the client's timeout arithmetic.
4. Trigger timeout disablement: The client processes the malicious value, either disabling its I/O timeout outright (non-positive value path) or causing the timeout computation to overflow and produce a negative poll timeout (overflow path), causing the client to wait indefinitely.
5. Exhaust daemon slots: By maintaining multiple such stalled connections, the attacker occupies all available rsync daemon connection slots, preventing legitimate clients from connecting and achieving denial of service (GitHub Advisory).

• Network: Unusually high number of long-lived, idle TCP connections to rsync daemon port (default 873); connections that remain open without transferring data for extended periods.
• Process: rsync daemon processes in a spin or hung state consuming CPU or holding open file descriptors without progress; poll() calls with negative timeout values visible via strace.
• Logs: rsync daemon logs showing connections that never complete or terminate; absence of expected timeout-related disconnection log entries for stalled sessions.
• System Resources: Gradual exhaustion of rsync daemon connection slots (max connections reached); system resource monitors showing rsync daemon holding an abnormal number of open sockets (GitHub Advisory).

Upgrade rsync to version 3.5.0 or later, which caps peer-supplied MSG_IO_TIMEOUT values on receipt and uses overflow-safe arithmetic in set_io_timeout(). Distribution-specific patches are available from SUSE (SUSE-SU-2026:3634-1, SUSE-SU-2026:3657-1), openSUSE, Fedora (Fedora 43 and 44), and FreeBSD. As a workaround, restrict rsync daemon access to trusted networks using firewall rules, and implement network-level connection monitoring to detect and terminate abnormally long idle rsync sessions. Microsoft has also issued guidance for affected Azure Linux 3 packages (GitHub Release, Microsoft MSRC, SUSE Advisory).

The vulnerability was assigned moderate severity by the rsync project maintainer Andrew Tridgell (tridge), who published the GitHub Security Advisory on August 13, 2026. Multiple Linux distributions including SUSE, openSUSE, and Fedora issued security updates promptly following disclosure. Tenable released multiple Nessus detection plugins (IDs 335052, 337988, 338828, 341040) and Qualys added detection (ID 290055). Coverage appeared in German Linux security outlet pro-linux.de and was tracked by AusCERT (GitHub Advisory, SUSE Advisory).