Description

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T15:20:00.267Z",
  "pubdate": "2026-08-13T15:20:00.267Z",
  "executiveSummary": "A signed integer overflow vulnerability exists in the I/O timeout implementation of rsync versions 3.1.0 before 3.5.0.\nThe vulnerability allows remote attackers to permanently disable connection timeouts by injecting malicious MSG_IO_TIMEOUT messages carrying zero or negative values.\nSuccessful exploitation causes the internal timeout variable to wrap around to a non-positive integer, effectively neutralizing the timeout validation mechanism.\nThe primary impact of this flaw is resource exhaustion, as idle or stalled connections can hold daemon slots indefinitely, potentially leading to a denial of service (DoS) condition.\nAttackers require network access to the rsync daemon to inject the crafted protocol messages, exploiting the lack of robust input validation on received timeout values.\nRisk implications include operational disruption and denial of service against vulnerable rsync server infrastructures.",
  "technicalDetails": "The root cause of the vulnerability resides in the I/O timeout handling logic within the rsync daemon, specifically concerning how MSG_IO_TIMEOUT protocol messages are parsed and processed.\nAffected software versions include rsync 3.1.0 up to, but not including, 3.5.0.\nThe vulnerable component is the I/O timeout implementation responsible for monitoring idle or stalled network connections and terminating them when a specified threshold is reached.\nAuthentication and privilege requirements depend on the rsync daemon configuration, but network exposure is inherent to any publicly accessible rsync service accepting network connections.\nExploitation occurs when an attacker crafts and injects malicious MSG_IO_TIMEOUT messages containing non-positive (zero or negative) integer values into the data stream.\nBecause the underlying code processes these values insecurely without adequate bounds or sign checking, the mathematical operations or assignments involving the timeout variable lead to a signed integer overflow.\nThe integer wrap-around results in a non-positive value being stored in the timeout tracking variable.\nConsequently, the conditional logic responsible for evaluating whether a connection has exceeded its idle time fails to trigger, as the comparison checks against positive timeout thresholds are invalidated.\nPost-exploitation impact manifests as persistent resource exhaustion.\nStalled or idle connections remain open indefinitely, consuming daemon slots, memory, and file descriptors.\nAs attackers exhaust available daemon slots, legitimate clients are denied service, fulfilling a denial of service attack vector against the rsync infrastructure."
}