CVE-2026-70462: rsyncproject rsync Integer Overflow or Wraparound

Vulnerability summary

CVE-2026-70462 is a high (CVSS 7.1) Integer Overflow or Wraparound vulnerability in rsyncproject rsync. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities.

Timeline

1. 13-08-2026
   PublishedVulnerability first disclosed.
2. 14-08-2026
   Last modifiedVulnerability information updated.

Description

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.