ALPINE-CVE-2026-70464
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.
ALPINE-CVE-2026-70464
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALPINE-CVE-2026-70464
rsync
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
rsync
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
rsync
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
rsync
Source reference: /affected/3/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.5.0-r0
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70464.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70464.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70464.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.0-r0"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:apk/alpine/rsync?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70464.json"
},
"ecosystem_specific": {}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55150 · Revision 1
- Added to Heist Feed
- Publisher date