CVE-2026-70455: Samba Rsync

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Affected products

• Samba Rsync: from 3.4.2, before 3.5.0 (fixed in 3.5.0)

Published 2026-08-13. Last modified 2026-08-31.