CVE-2026-70459: falha de média gravidade em RsyncProject rsync
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.7%
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
RsyncProject · rsyncCVEs relacionadas — RsyncProject rsync
No mesmo produto, das mais perigosas para as menos.
CVE-2026-43618MEDIUMRsync < 3.4.3 Integer Overflow Information DisclosureEPSS 0.8%CVE-2026-70464HIGHrsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake StallEPSS 0.6%CVE-2026-53790CRITICALrsync < 3.5.0 Command Injection via Multiple Code PathsEPSS 0.6%CVE-2026-119741HIGHrsync < 3.5.2 Denial of Service via hash_search() Checksum CollisionsEPSS 0.6%CVE-2026-70461HIGHrsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from EntryEPSS 0.6%CVE-2026-70455HIGHrsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread ExhaustionEPSS 0.6%