rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
CVE-2026-70462 is fixed in 4 products on 1 platform, first by SUSE-SU-2026:3657-1, released August 20, 2026. It is not reported as exploited. Patch Radar priority: Routine.
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| rsync · Debian 13.5 (trixie) | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-70462 | Aug 27, 2026 |
| rsync · Debian 14 | 3.5.0+ds1-1 | DEBIAN-CVE-2026-70462 | Aug 27, 2026 |
| rsync · amzn 2023 | 3.5.1-1.amzn2023.0.1 | ALAS2023-2026-3131 | Sep 28, 2026 |
| rsync · opensuse-leap 16.0 | 3.4.1-160000.6.1 | OPENSUSE-SU-2026:21650-1 | Aug 26, 2026 |
| rsync · sles 15.6 | 3.2.7-150600.3.24.1 | SUSE-SU-2026:3657-1 | Aug 20, 2026 |
| rsync · sles 15.7 | 3.2.7-150600.3.24.1 | SUSE-SU-2026:3657-1 | Aug 20, 2026 |
| rsync · sles 16.0 | 3.4.1-160000.6.1 | SUSE-SU-2026:23323-1 | Aug 26, 2026 |
| rsync-daemon · amzn 2023 | 3.5.1-1.amzn2023.0.1 | ALAS2023-2026-3131 | Sep 28, 2026 |
| rsync-debuginfo · amzn 2023 | 3.5.1-1.amzn2023.0.1 | ALAS2023-2026-3131 | Sep 28, 2026 |
| rsync-debugsource · amzn 2023 | 3.5.1-1.amzn2023.0.1 | ALAS2023-2026-3131 | Sep 28, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.