CVE-2026-70453 — rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a care…
Published: 2026-08-13 · CVSS: 8.7 · CVSS 4.0
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7