High severity7.5NVD Advisory· Published Aug 13, 2026· Updated Nov 6, 2026
CVE-2026-70453
CVE-2026-70453
Description
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords5 versionspkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/rsync-daemonpkg:rpm/almalinux/rsync-rrsyncpkg:rpm/almalinux/rsync
< 3.5.1-1.1+ 4 more
- (no CPE)range: < 3.5.1-1.1
- (no CPE)range: < 3.4.1-160000.6.1
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
Patches
Vulnerability mechanics
References
3- github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hvnvdVendor Advisory
- www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-searchnvdThird Party Advisory
- github.com/RsyncProject/rsync/releases/tag/v3.5.0nvdRelease Notes
News mentions
1- Rsync: 25 Vulnerabilities Disclosed Together, Affecting Versions Before 3.5.0Vypr Intelligence · Aug 13, 2026