CVE-2026-70464: rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall
RsyncProject · rsync
Fixed in 3.5.0 · Affected: RsyncProject before 3.5.0 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 51% of scored CVEs
DescriptionCVE.org
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- RsyncProject · rsyncfrom 2.0.0 up to and including 3.4.4
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- RsyncProject
- Published
- August 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-70464 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.