CVE-2026-70462
Medium
Description
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
SeverityMedium
CVSS6.5
Exploit probability—
ProductSamba Rsync
PublishedAug 13, 2026
First seenAug 13, 2026
Weakness typeCWE-190Integer overflowCWE-835CWE-835
How to fix
Update
- samba rsync3.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba rsync | 3.1.0 ≤ v < 3.5.0 | 3.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.