MEDIUMVulnerability
CVE-2026-70462
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
Properties
- severity
- MEDIUM
- score
- 6.5
- epss_score
- 0.00259
- cve_id
- CVE-2026-70462
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- published_at
- 2026-08-13T15:20:00.267
- last_modified
- 2026-09-08T20:28:37.587
- epss_percentile
- 0.17448
Related Entities (4)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (2)
→[Weakness]Loop with Unreachable Exit Condition ('Infinite Loop')
→[Weakness]Integer Overflow or Wraparound
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph