CVE-2026-70455

HIGH

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Published: 8/13/2026Modified: 8/14/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-70455 — rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows ...

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting

CVE-2026-70455
NIST NVD

References (3)

https://github.com/RsyncProject/rsync/releases/tag/v3.5.0https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion