CVE-2026-70455

Katalog CVE

CVSS 7.5 · High EPSS 0,57%

Kerentanan Allocation of Resources Without Limits or Throttling pada samba rsync. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9 advisory vendor
• https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes