CVE-2026-70462

Katalog CVE

CVSS 6.5 · Medium EPSS 0,45%

Kerentanan Integer Overflow or Wraparound. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
• https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64
• https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout