Medium [CVE-2026-70462] Denial of Service via signed integer overflow in I/O timeout

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values.

Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion. A flaw was found in rsync.

A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely.

This leads to resource exhaustion, preventing legitimate users from accessing the rsync service and resulting in a denial of service. This is a Moderate denial of service flaw in rsync, where a remote, unauthenticated attacker can exhaust system resources.

The impact is limited to denial of service and does not allow for arbitrary code execution or data compromise. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

Weakness: CWE-190.