Description
rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.
Published: 2026-08-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a null pointer dereference in the rsync daemon child process that occurs when the daemon processes a file list whose first entry is a dot entry that is incorrectly treated as a directory. This causes the daemon to dereference an invalid or uninitialized pointer and terminate the client connection, resulting in a denial of service. The flaw is classified as CWE-908.

Affected Systems

Vendor RsyncProject. Product rsync. Affected versions include all releases from rsync 3.0.0 through 3.4.x. Any rsync instance that is running a susceptible version and exposed to external hosts can be impacted.

Risk and Exploitability

The CVSS score of 6.9 denotes a medium severity, with a remote attack vector that can cause service disruption. The EPSS score is not available, so the current probability of exploitation remains unclear, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the crash by initiating a sync operation with a crafted file list from a remote host, potentially bringing the rsync daemon down for that session. The impact is restricted to availability; there is no known code execution or data disclosure.

Generated by OpenCVE AI on August 13, 2026 at 17:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade rsync to version 3.5.0 or later, which includes the fix for the null pointer dereference in the file list handling
  • If an immediate upgrade is not possible, limit inbound traffic to the rsync listening port to trusted hosts or networks to reduce exposure while monitoring for unexpected failures
  • Maintain an up‑to‑date inventory of rsync deployments and regularly check the vendor site or advisories for new patches or updates

Generated by OpenCVE AI on August 13, 2026 at 17:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Samba
Samba rsync
CPEs cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*
Vendors & Products Samba
Samba rsync

Fri, 14 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Rsync Project
Rsync Project rsync
Vendors & Products Rsync Project
Rsync Project rsync

Thu, 13 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.
Title rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
Weaknesses CWE-908
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Rsync Project Rsync
Samba Rsync
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-14T19:45:59.519Z

Reserved: 2026-08-04T14:52:23.814Z

Link: CVE-2026-70459

cve-icon Vulnrichment

Updated: 2026-08-14T18:30:19.645Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-13T15:19:59.813

Modified: 2026-08-31T15:11:24.083

Link: CVE-2026-70459

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T10:00:03Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource