Null Pointer Dereference Vulnerability in Rsync Daemon Process

CVE-2026-70459

What is CVE-2026-70459?

Rsync versions prior to 3.5.0 are affected by a null pointer dereference vulnerability within the daemon child process. This weakness allows remote attackers to crash the daemon by submitting a malformed file list, where the first entry is a dot entry that is not recognized as a directory. The daemon erroneously attempts to dereference this entry as a directory structure, leading to an invalid pointer dereference that results in the termination of the client connection. It is crucial for users of Rsync to apply the appropriate patches or upgrades to mitigate potential exploitation.

References