CVE-2026-70459
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
rsync versions 3.0.0 through before 3.5.0 contain a null pointer dereference vulnerability in the daemon child process. A remote attacker can send a file list whose first entry is a dot entry not typed as a directory, causing an invalid pointer dereference that terminates the client connection.
Risk Assessment
An attacker can crash the rsync daemon, leading to service disruption.
Recommendation
Update rsync to version 3.5.0 or later.
Original NVD description (English source)
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.