CVE-2026-70453: Rsyncproject Rsync

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.

Affected products

• Rsyncproject Rsync: up to and including 3.4.4

Published 2026-08-13. Last modified 2026-09-08.