CVE-2026-70453
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Aug 13, 2026
Vendor
unknown
Description
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.