CVE-2026-70455 RsyncProject CVE debrief

Who should care

System administrators and security teams responsible for rsync installations should be aware of this vulnerability and take steps to mitigate it. This includes reviewing system configurations, monitoring for unusual activity, and implementing resource limits for rsync processes. Affected operator, platform, vulnerability-management, and security-team impact should be assessed, and compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Owners should be assigned for follow-up and exceptions should be tracked, with retesting of remediated assets and closure only after evidence is documented. Managed environments should be reviewed for potential exposure, and asset inventory should be updated accordingly. Change management processes should be used for vendor-supported updates or mitigations where exposure is confirmed. Monitoring, detection, and logs should be checked for exposed assets that need extra review. Rollback/change windows should be planned for remediation, and source tracking should be implemented to monitor for potential attacks. Security teams should prioritize patching rsync installations to prevent potential resource exhaustion attacks and implement compensating controls for exposed systems while remediation is scheduled and verified. System administrators should review compensating controls for exposed systems while remediation is scheduled and verified and track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should review relevant monitoring, detection, and logs for exposed assets that need extra review and implement resource limits for rsync processes to prevent potential resource exhaustion attacks. System administrators and security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. System administrators and security teams should check relevant and (

Technical summary

The CVE-2026-70455 vulnerability affects rsync versions 3.4.2 and earlier. A remote attacker can cause a denial of service by specifying the --zt option with a large value, which spawns an unbounded number of Zstandard worker threads, exhausting available thread and memory resources. The vulnerability has a CVSS score of 8.7 and is considered high severity. The --zt short alias for --compress-threads bypasses the refuse options directive's string matching on long option names. Limited details are available on the attack vector and potential impact, but defenders should verify system configurations and monitor for unusual activity.

Defensive priority

System administrators and security teams should prioritize patching rsync installations to prevent potential resource exhaustion attacks.

Recommended defensive actions

• Patch rsync installations to version 3.5.0 or later
• Restrict access to rsync services to trusted sources
• Monitor rsync logs for unusual activity
• Implement resource limits for rsync processes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-70455 record indicates a denial of service vulnerability in rsync 3.4.2 before 3.5.0. The vulnerability allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, bypassing the refuse options directive's string matching on long option names. Limited details are available on the attack vector and potential impact, but the CVSS score is 8.7, indicating a high severity vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.