CVE-2026-70455 Threat Intelligence Report

Document Classification: TLP:CLEAR
Date: 2026
Prepared By: Valtersit Threat Intelligence
Audience: Enterprise Security Teams, SOC Analysts, Penetration Testers

Executive Summary

CVE-2026-70455 is unpatched (patch confidence 0/4) denial-of-service vulnerability in rsync 3.4.2 through 3.5.0-rc1 — reachable by an unauthenticated, remote sender targeting an rsync receiver daemon. The flaw lets a remote attacker bypass the refuse options directive's string-matching protections by supplying the short alias --zt for --compress-threads, and then specifying --zt=N with an arbitrarily large value. The receiver spawns an unbounded number of Zstandard (zstd) worker threads, exhausting memory and thread limits to crash the target process or entire host. With AV:N / PR:N / UI:N / S:U / C:N / I:N / A:H (CVSS 7.5), the vulnerability is remotely triggerable with zero privileges, no user interaction, and requires no existing foothold — a critical availability concern for any enterprise relying on rsync-over-daemon for backup, replication, or content distribution.

Technical Analysis

Vulnerability Mechanism

rsync is a file-synchronization utility that runs in one of two operational modes — as a client (sender) or a daemon (receiver). When run as a daemon on port 873/TCP (or over an SSH transport), the receiver parses command-line options received from the remote sender. Administrators commonly enforce refuse options in rsyncd.conf to block dangerous flags (e.g., --delete, --compress) from being set by remote clients.

The flaw lies in a short-option alias bypass:

• --zt is an undocumented short alias for --compress-threads.

• The refuse options directive performs string matching on the long option name (compress-threads) but fails to match the short alias (-zt).

• A malicious remote sender passes --zt=N where N is any large integer.

• The receiver treats this as --compress-threads=N, which spawns N Zstandard worker threads — each requiring its own thread stack (typically 8–16 MB virtual) and associated memory context.

• There is no upper-bound validation on N; an attacker can specify values in the tens of thousands, immediately exhausting:

  • Process thread limit (RLIMIT_NPROC / pthread_max)
  • Available memory via thread stack allocation
  • CPU scheduling as the kernel attempts to schedule a massive thread pool

The result is a complete denial of service — the rsync daemon process either exhausts memory and dies, becomes unresponsive, or the entire host destabilizes (OOM-killer invoked). On multi-tenant hosts, this may crash collocated services.

Attack Surface

The attack is trivially scriptable — a single rsync -zt=999999 source/ target/ invocation or a raw protocol handshake suffices. The vulnerability is independent of the data being transferred; a zero-byte file transfer can trigger the option parsing flaw.

Root Cause Class

This is a CWE-770: Allocation of Resources Without Limits or Throttling. The software fails to bound the number of configurable worker threads based on architecture-specific constraints (CPU count, available RAM). This is distinct from a logic bug — the design allows unbounded resource allocation by design, but the refuse options mechanism was intended to mitigate it. The short-alias match bypass renders that mitigation useless.

Exploitation Scenarios

Note: No public PoC is available at the time of writing. The attack chain below is inferred from the NVD description and vulnerability class; specific implementation details are not fabricated.

Attack Chain

Step 1 — Reconnaissance / Target Identification

• Attacker scans for hosts exposing port 873/TCP or SSH with rsync configured (/usr/bin/rsync with --daemon in inetd/xinetd).
• Tools: Shodan dork port:873, banner grabbing via rsync --version or raw socket connection to retrieve the rsync banner (e.g., @RSYNCD: 31.0).
• Attacker confirms version falls in the 3.4.2 ≤ version < 3.5.0 range.

Step 2 — Flaw Trigger

• Attacker establishes a connection to the rsync daemon and authenticates to an accessible module (anonymous read access is often enabled by default for public mirrors).
• During option negotiation, the attacker specifies --zt=100000 (or higher).
• Because the refuse options directive checks only the long name compress-threads, the short alias -zt passes the filter.

Step 3 — Payload / Execution Method

• The receiver processes --zt=100000 as --compress-threads=100000.
• The rsync process attempts to initialize 100,000 Zstandard worker threads.
• Each thread allocation consumes kernel resources; the process quickly hits RLIMIT_NPROC or exhausts virtual memory for thread stacks.
• The process either:
  • Crashes (SIGSEGV / SIGABRT from thread creation failure), or
  • Becomes unresponsive (deadlock / livelock in thread scheduler), or
  • Triggers host OOM-killer, killing the rsync process and potentially other processes.

Step 4 — Post-Exploitation Impact

• On the rsync process: service unavailable; subsequent legitimate sync attempts fail.
• On the host: if memory exhaustion is severe and no cgroup limits exist, the kernel's OOM-killer may terminate unrelated services (databases, web servers) on the same host.
• In enterprise environments: backup pipelines, CI/CD artifacts distribution, or web-server replication breaks — potentially causing cascading system degradation.

Variants

• Multiple concurrent connections: A single attacker can open many simultaneous low-resource connections, each spawning thousands of threads, amplifying the impact.
• SSH tunnel: If rsync is wrapped in SSH with rsync --server forwarding, the same --zt option passes through the SSH session, though SSH typically limits concurrent sessions.

Impact Assessment

CVSS Sub-score Analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — 7.5)

Business Impact

Blast Radius

• Directly affected: The rsync daemon process on the target host.
• Indirectly affected: Any process on the same kernel sharing memory/thread resources (mitigated by cgroups/containers).
• Downtime projection: Without a patch, manual process restart is required — restart alone does NOT resolve the issue, since the same attack can be re-triggered. Persistent availability threat until the upstream fix or workaround is deployed.

Detection Guidance

Detection rules below target both exploitation attempts (option negotiation with --zt) and indicative behavior (thread explosion / process failure).

Sigma Rule

title: Rsync Compress-Threads Short Alias DoS Attempt (CVE-2026-70455)
id: 8f9b2d1e-3a4c-4b9f-9e0a-c1d2e3f4a5b6
status: experimental
description: Detects rsync option negotiation containing -zt/--zt with a large value, indicating an attempt to trigger CVE-2026-70455.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-70455
author: Valtersit Threat Intel
date: 2026/01/01
logsource:
    category: process_creation
    product: linux
detection:
    selection_rsync:
        Image|endswith: '/rsync'
    selection_cmdline:
        CommandLine|contains|all:
            - '--server'          # receiver mode
        CommandLine|contains:
            - '--zt'              # short alias of --compress-threads
    selection_large_value:
        CommandLine|re: '(?i)\-\-zt\s*[= ]\s*\d{4,}'   # 4+ digits (>= 1000)
    condition: selection_rsync and selection_cmdline and selection_large_value
falsepositives:
    - Legitimate admins using -zt with reasonable values (unlikely >1000)
    - Backup tooling that may pass compress-threads explicitly
level: high

YARA Rule

rule rsync_zt_compress_threads_dos {
    meta:
        author = "Valtersit Threat Intel"
        description = "Matches rsync command-line strings attempting CVE-2026-70455"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-70455"
        date = "2026-01-01"
        cve = "CVE-2026-70455"
    strings:
        $a1 = "--zt" nocase
        $a2 = "-zt" nocase
        $b  = "--compress-threads" nocase
        $big = /\-\-zt[= ]\d{4,}/ nocase
    condition:
        // Captures both short-alias exploitation and long-form usage
        ( uint16(0) == 0x7f45 or filesize < 10MB ) and
        ( $a1 or $a2 ) and
        $big
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"CVE-2026-70455 rsync --zt compress-threads DoS attempt";
    flow:to_server,established;
    content:"--zt"; nocase; within:200;
    content:"--server"; nocase; distance:0; within:400;
    pcre:"/--zt(=|\s)\d{4,}/i";
    classtype:attempted-dos;
    reference:cve,2026-70455;
    sid:2026704551; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "rsync" and
  process.args : ("--server", "--daemon") and
  wildcard(process.command_line, "*-zt*") and
  regex(process.command_line, "--zt(=|\\s)\\d{4,}")

Splunk SPL Query

index=linux sourcetype=process_creation
| where match(CommandLine, "--zt[= ]\\d{4,}")
| search Image="*rsync*" OR Image="*/rsync"
| rename CommandLine as cmdline
| table _time host user cmdline process_id
| sort - _time

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100451" level="12">
    <decoded>rsync</decoded>
    <regex>(¬|--|-)zt(=|\s)\d{4,}</regex>
    <description>CVE-2026-70455: rsync compress-threads short-alias DoS attempt detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attempted_dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No upstream patch, vendor advisory, or CVE-fix commit is tracked. Upgrade path is to rsync 3.5.0+ per the NVD description (vulnerable range: 3.4.2 ≤ x < 3.5.0).

1. Immediate Mitigations (no patch available — implement all that apply)

2. Patch / Upgrade Steps

1. Monitor vendor channels (rsync.samba.org, GitHub WayneD/rsync releases) for a 3.5.x or later release that fixes the short-alias bypass.
2. When available: upgrade to the patched version — ideally >= 3.5.0.

   # Example (verify release availability first)
   wget https://download.samba.org/pub/rsync/rsync-3.5.0.tar.gz
   tar xzf rsync-3.5.0.tar.gz && cd rsync-3.5.0
   ./configure && make && sudo make install
   

3. Validate version post-upgrade: rsync --version should report ≥ 3.5.0.
4. Re-test with connect scenario to confirm the --zt option is either rejected or bounded.

3. Long-Term Hardening

• Remove anonymous access: Require auth users in rsyncd.conf with strong credentials.
• Disable compress-threads entirely in environments not requiring multi-threaded Zstandard compression.
• Implement resource caps for ALL network services (systemd MemoryMax=, TasksMax=, LimitNPROC=).
• Use SSH-tunneled rsync exclusively — SSH provides authentication, integrity, and option-whitelisting semantics.
• Regular audit of rsync version and configuration against CVE databases.
• Harden the host kernel: enable kernel.pid_max limits and cgroup v2 resource controls.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-70455 (authoritative source for description, CVSS, CWE)
2. rsync Project Home — https://rsync.samba.org/ (vendor project; monitor for release notes addressing this CVE)
3. rsync GitHub Repository — https://github.com/WayneD/rsync (watch for upstream commit fixing short-alias bypass)
4. CWE-770 Reference — https://cwe.mitre.org/data/definitions/770.html (Allocation of Resources Without Limits or Throttling)
5. CISA KEV — Not listed (as of this report; no known in-the-wild exploitation has been confirmed, but the attack is trivial to implement once the rsync daemon surface is exposed)

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-70455 at this time. However, the vulnerability is technically trivial to exploit (single option injection) and likely to be incorporated into botnet-based DDoS tooling targeting exposed rsync daemons once a PoC circulates.

TLP Classification: TLP:CLEAR — Distribution unlimited.
Next Review: 30 days from publication or upon disclosure of a vendor patch.

This report was generated by Valtersit Threat Intelligence for internal enterprise defensive use. All technical claims are derived from the provided CVE intelligence data; where specific implementation details are unavailable, the report describes the vulnerability class without fabrication.