CVE-2026-70455

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70455
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-70455.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-70455
Aliases
  • GHSA-rjvj-qgqg-cvx9
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
ECHO (1)
MGASA (1)
openSUSE (2)
RHSA (1)
RLSA (1)
ROOT (1)
SUSE (6)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (6)
Published
2026-08-13T14:45:11Z
Modified
2026-10-22T10:36:12Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
Details

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70455.json"
}
References

Affected packages

Git / github.com/rsyncproject/rsync

Affected ranges

Type
GIT
Repo
https://github.com/rsyncproject/rsync
Events
Introduced
de3cc03b03be153092f266aa1117b4706947ed07
Fixed
471e17dc0d68233db84db11be82c9f62f4661214
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.2"
                },
                {
                    "fixed": "3.5.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "original_tag": "v3.5.0",
            "range": [
                {
                    "fixed": "471e17dc0d68233db84db11be82c9f62f4661214"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v3.*
v3.4
v3.4.2
v3.4.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-70455.json"