TI-2026-49232 Aliases CVE-2026-70459

rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry

LOW 38CWE-908Published 2026-08-13 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00721 54th percentileScored 2026-11-07

Fix Partial rsync (RsyncProject): 3.5.0Red Hat: 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Samba	rsync	3.0.0 – 3.4.4	3.5.0	Patch available	CNA

rsync VendorSamba Affected 3.0.0 – 3.4.4 Fixed in 3.5.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:samba:rsync::::::::	3.0.0 to before 3.5.0	Vulnerable	Samba

cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.5.0 Vulnerable ·Samba

Remediation

Fix · CNA rsync (RsyncProject) Fixed in 3.5.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	—
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 5	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-70459
2026-11-06 Affected versions changed · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

GitHub Security Advisory (GHSA-p4v4-qxw9-q72m)

Other 1

rsync 3.5.0 Release Notes

TI-2024-11208 Rsync: heap buffer overflow in rsync due to improper checksum length handling CVSS 3.1CRITICAL 9.8
TI-2024-11209 Rsync: info leak via uninitialized stack contents CVSS 3.1HIGH 7.5
TI-2024-11212 Rsync: --safe-links option bypass leads to path traversal CVSS 3.1HIGH 7.5
TI-2024-11211 Rsync: path traversal vulnerability in rsync CVSS 3.1HIGH 7.5
TI-2024-11210 Rsync: rsync server leaks arbitrary client files CVSS 3.1MEDIUM 6.8
TI-2017-12160 The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not… CVSS 3.1CRITICAL 9.8

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences