CVE-2026-70453

Name
CVE-2026-70453
Description
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
disclosure@vulncheck.com https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv
disclosure@vulncheck.com https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
rsync edge-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.24-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.23-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.22-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.21-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed