CVE-2026-70459CWE-908

CVE-2026-70459

Medium · published August 13, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00721 · 53.4th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2026-08-13T19:19Z
Affected products (1)
ProductVersionsFixed in
samba/rsync≥ 3.0.0, < 3.5.03.5.0
References (3)
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 · [email protected]https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m · [email protected]https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry · [email protected]
EPSS history
Timeline
  • 13 AUG 14:43Z
    rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
    cvelistv5