Algorithmic Complexity Vulnerability in rsync Affects Remote Operations

CVE-2026-70453

What is CVE-2026-70453?

The rsync file synchronization software prior to version 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function. This weakness allows remote attackers to exploit the system by sending a specially crafted file list that can lead to a denial of service. The exploitation takes advantage of the quadratic-time behavior occurring during hash lookups, which can significantly exhaust the CPU resources of the receiver with only a manageable number of carefully designed entries. As a result, this can lead to prolonged periods of unavailability for services that utilize rsync.

References