CVE-2026-70459

Executive Summary

CVE-2026-70459 is a null pointer dereference vulnerability in the rsync daemon's child process, affecting rsync versions 3.0.0 up to but not including 3.5.0. An unauthenticated remote attacker can crash the daemon by sending a crafted file list whose first entry is a dot entry (".") not typed as a directory, causing the daemon to dereference an invalid directory pointer and terminate the client connection. The vulnerability is rated CVSS 5.3 (Medium) with limited availability impact, is not listed in CISA KEV, and no public exploit code or PoC has been observed as of this report.

Technical Analysis

The rsync daemon operates in two primary modes: a one-shot client/server mode over SSH, and a long-running daemon mode that listens on TCP port 873 by default. In daemon mode, the server accepts client connections, negotiates an rsync module, and spawns a child process to handle the transfer. The file-list exchange is the first substantive protocol step after session negotiation: the client enumerates the files and directories to be transferred, and the server parses this list to build its transfer state.

The vulnerability class here is a missing type validation during file-list parsing. Within the rsync file-list wire format, each entry carries type metadata identifying whether the entry is a directory, regular file, symlink, device, or the special dot entry (".") that represents the current/top-level directory. Per the NVD description, the daemon child process fails to verify the entry type before dereferencing the first file-list entry as a directory-structure pointer. If the attacker places a dot entry first but does not type it as a directory, the parser dereferences a NULL or uninitialized pointer, resulting in a crash of the child process and termination of the client connection.

The vulnerability is categorized under CWE-908 (Use of Uninitialized Resource): the pointer in question was never properly initialized or validated before use. Although the observed failure mode is a null/invalid pointer dereference, the root cause is the parser's failure to confirm that the entry type field is consistent with a directory structure before dereferencing it. The NVD description does not disclose the vulnerable function names, struct layouts, or the precise parser routine; such implementation-level detail is insufficient in the public advisory data, so the analysis remains at the mechanism/class level.

Attack surface characteristics derived from the CVSS vector: the attack is network-reachable (AV:N), requires low attack complexity (AC:L), requires no privileges (PR:N), and requires no user interaction (UI:N). This indicates the flaw is triggerable by a pre-authentication remote client against an exposed rsync daemon. The availability impact is rated Low (A:L), which suggests the primary observable consequence is the crash of a daemon child process (and consequent dropped connection) rather than a full parent-daemon outage — though repeated exploitation could still degrade service.

Notably, the EPSS score for this CVE is 0.00383 (31.5% percentile of exploited CVEs), indicating a low current probability of exploitation in the wild. There is no CISA KEV entry, no Nuclei template, and no known exploit code. The patch status is ambiguous: the NVD description implies a fix in rsync 3.5.0, and a single OSV source claims a patch, but that claim is not independently confirmed (patch confidence 2/4), and the referenced OSV package commit is marked "unfixed."

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance / Target Identification. An attacker identifies rsync daemons exposed to the network by scanning for TCP port 873 or using internet-wide search engines (Shodan dorks above: "port:873", "product:rsync", "@RSYNCD:" banner). The rsync daemon greeting ("@RSYNCD: ") confirms the service and, if versioned 3.0.0 through 3.4.x, indicates likely vulnerability.

2. Triggering the Flaw (Protocol-level). The attacker connects to the daemon, completes the initial handshake, and begins sending a file list. The crafted list places a dot entry (".") as the first entry, and that dot entry is intentionally not typed as a directory. The NVD description states the daemon dereferences this first file-list entry as a directory structure pointer without verifying the entry type — this is the precise condition that triggers the vulnerability. The description does not specify whether module-level authentication must succeed before the file-list parser is reached; the CVSS vector (PR:N) indicates no privileges are required, but insufficient technical detail is available to confirm the exact protocol state at the point of the crash.

3. Execution Method. At the vulnerability-class level, this is a malformed-input to a parser: the attacker ships protocol-malformed metadata (an entry whose type flag contradicts its semantic content). The daemon child process dereferences the invalid/uninitialized pointer, causing a segmentation fault and process termination. No memory-corruption payload or code execution is implied; the impact is confined to process crash.

4. Post-Exploitation Impact. The daemon child process crashes and the client connection is terminated. Repeating the attack against a target daemon can produce a crash loop that denies file-transfer service to legitimate users, backup jobs, and mirroring or CI/CD pipelines. Because the crash occurs in the child process, the parent daemon may continue running and respawn children, which is consistent with the Low availability impact subscore (A:L); however, in high-throughput environments or on constrained hosts, repeated child crashes can still lead to resource exhaustion and broader denial of service. There is no confidentiality or integrity impact (C:N, I:N).

Impact Assessment

Business impact. rsync is a ubiquitous file-transfer and synchronization tool embedded in enterprise backup systems, software mirroring infrastructure, CI/CD artifact propagation, and server-to-server replication. An unauthenticated, network-reachable crash of the rsync daemon therefore has direct operational availability consequences for any organization exposing rsync daemons — in particular, anonymous module deployments or services reachable from untrusted networks.

Affected systems. All rsync installations in daemon mode with versions 3.0.0 through 3.4.x. Client-only installations and rsync-over-SSH usage are not relevant to the daemon attack surface unless the SSH session lands on a vulnerable daemon path. Because the Affected Versions list in the CVE metadata is empty, operational teams must rely on the NVD description range (3.0.0 ≤ version < 3.5.0).

Blast radius. The CVSS base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. Subscore analysis: confidentiality and integrity are unaffected; availability is Low. The technical blast radius is limited to the daemon child process and its client connection, but the operational blast radius can be wider in environments that treat rsync as a critical availability component (e.g., scheduled backup windows). The EPSS score of 0.00383 (31.5% percentile) and absence from CISA KEV suggest this is not currently an actively exploited vulnerability, and exploitation likelihood should be considered low at this time.

Detection Guidance

The following detection logic targets (a) daemon child processes terminating abnormally with SIGSEGV/exit code 139, (b) repeated malformed rsync file-list attempts in daemon logs, and (c) network sessions to rsync ports exhibiting protocol anomalies. Given that no public PoC exists and the exact wire-level trigger byte sequence is not disclosed in the advisory data, network signatures are heuristic and should be tuned against local baseline traffic.

Sigma Rule

title: Rsync Daemon Child Process Crash - Potential CVE-2026-70459
id: 3f7c9a2e-5b41-4d6e-9c1d-2a8e7f04c560
status: experimental
description: Detects rsync daemon child processes terminating with SIGSEGV (exit code 139) after handling a client connection. This behavior is consistent with the null/invalid pointer dereference described in CVE-2026-70459, where a malformed file-list first entry crashes the daemon child.
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
  category: process_termination
  product: linux
detection:
  selection_sigsegv:
    Image|endswith: '/rsync'
    ExitCode: 139
  selection_daemon_context:
    ParentImage|endswith: '/rsync'
  condition: selection_sigsegv or selection_daemon_context
falsepositives:
  - Rsync daemon killed by external memory limits or OOM killer
  - Local developers crashing rsync during debugging
level: high
tags:
  - attack.t1499
  - attack.t1499.004
  - cve.2026-70459

YARA Rule

/*
   CVE-2026-70459 - Hunting rule for tooling that crafts malformed rsync file lists
   targeting the daemon child process (null pointer dereference on first dot entry).
   No public PoC exists; this rule hunts for pre-attack tooling and exploit scaffolds.
*/
rule CVE_2026_70459_rsync_filelist_dos_tooling
{
    meta:
        author      = "Valtersit Threat Intelligence"
        description = "Detects scripts or binaries that construct rsync daemon handshakes and malformed file lists (CVE-2026-70459)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-70459"
        cve         = "2026-70459"
        date        = "2026-01-01"

    strings:
        $s1 = "@RSYNCD:" ascii wide
        $s2 = "rsync" ascii wide nocase
        $s3 = "file list" ascii wide nocase
        $s4 = "dot entry" ascii wide nocase
        $s5 = "--server" ascii wide
        $s6 = "daemon" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F   // PE or ELF
        and 2 of ($s1, $s2, $s3, $s4)
        or (filesize < 2MB and $s1 and $s2 and $s6)
}

Suricata IDS Rule

# Heuristic rule: flags rsync daemon sessions (TCP 873) where the protocol
# greeting is followed by a file-list exchange containing a leading dot entry
# (".") inconsistent with a directory type. Adjust threshold/sid per deployment.
alert tcp any any -> any 873 ( \
    msg:"ET EXPLOIT Possible CVE-2026-70459 rsync daemon malformed file-list DoS attempt"; \
    flow:established,to_server; \
    content:"@RSYNCD:"; nocase; \
    content:"."; \
    content:"|0a|"; \
    pcre:"/\.(?:\x00|$)/R"; \
    classtype:attempted-dos; \
    reference:cve,2026-70459; \
    sid:202670459; rev:1;)

Elastic Detection

// EQL: detect a sequence of an inbound rsync connection to port 873 followed
// by an abnormal termination (SIGSEGV, exit code 139) of the rsync process.
sequence by host.id with maxspan=10m
  [ network where event.category == "network" and destination.port == 873
      and process.name == "rsync" ]
  [ process where event.category == "process" and event.type == "end"
      and process.name == "rsync" and process.exit_code == 139 ]

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=syslog
  (process_name="rsync" OR exe="*/rsync" OR COMMAND="*rsync*")
  | search exit_code=139 OR sig=SIGSEGV OR status=139
  | stats count earliest(_time) latest(_time) by host, process_name, parent_process_name
  | where count >= 3
  | eval alert="Potential CVE-2026-70459 rsync daemon crash loop",
          mitre_tactic="T1499 - Endpoint Denial of Service"
  | table _time, host, count, parent_process_name, alert, mitre_tactic

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100345" level="10" frequency="3" timeframe="300">
    <if_sid>500</if_sid>
    <program_name>^rsync</program_name>
    <match>segfault|SIGSEGV|invalid pointer|file list|unexpected</match>
    <description>CVE-2026-70459: Possible rsync daemon null pointer dereference triggered by malformed file list</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>rsync_dos,</group>
  </rule>

  <rule id="100346" level="7">
    <program_name>^rsync</program_name>
    <match>file list|ERROR</match>
    <description>Rsync daemon reported a file-list processing error (possible CVE-2026-70459 reconnaissance)</description>
    <group>rsync_anomaly,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-70459 is 2/4 (CLAIMED): a single OSV source claims a fix, but it is not independently confirmed, and the referenced OSV package commit (4cb6197b21d9860736c8e6d81b8eb8cac53beb5a) is listed as "unfixed." The NVD description indicates the issue is resolved in rsync 3.5.0.

1. Immediate mitigations. Restrict network access to rsync daemon TCP port 873 to trusted hosts and networks via firewall/ACL rules; if the daemon is not required, disable daemon mode entirely and use rsync over SSH for transfers. Disable anonymous rsync modules and enforce host allow-lists (hosts allow) to reduce the unauthenticated attack surface. Run the rsync daemon under a dedicated, unprivileged account and consider a container or chroot to contain child-process crashes.

2. Patch/upgrade steps. Upgrade rsync to version 3.5.0 or later once the vendor release is confirmed — the current fix claim originates from a single OSV source, so validate the upstream release notes and test the upgrade in a staging environment before production rollout. Track the OSV advisory status for package commit 4cb6197b21d9860736c8e6d81b8eb8cac53beb5a and monitor rsync official distribution channels for a definitive patched release. Until the patch is independently verified, treat daemon-mode rsync as at-risk.

3. Long-term hardening. Segment rsync services onto dedicated management networks; apply rate limiting and connection thresholds at the network layer to blunt crash-loop attempts; enable and centralize rsync daemon logging to support the detection rules above; subscribe to CVE and EPSS feeds for this product family. Given the low EPSS score (0.00383) and the absence of CISA KEV inclusion, prioritize this issue as medium severity but do not defer patching indefinitely.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-70459
• OSV advisory: https://osv.dev/vulnerability/CVE-2026-70459
• CWE-908 (Use of Uninitialized Resource): https://cwe.mitre.org/data/definitions/908.html
• rsync official project site: https://rsync.samba.org/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-70459 not listed)

As of the reporting date, no known threat-actor campaigns, exploit-in-the-wild evidence, or public PoCs have been observed for this vulnerability.