Is CVE-2026-70453 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-70453?

CVE-2026-70453 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-70453

Description

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.