Description

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T15:20:01.667Z",
  "pubdate": "2026-08-13T15:20:01.667Z",
  "executiveSummary": "A denial of service vulnerability exists in the rsync daemon affecting versions 2.0.0 through 3.5.0.\nThe vulnerability allows unauthenticated remote attackers to completely exhaust available daemon connection slots.\nThe impact results in a total denial of service for legitimate clients attempting to connect to the rsync service.\nAffected systems comprise rsync daemon instances running vulnerable software versions exposed to network interfaces.\nThe risk implications are severe as service availability is compromised without requiring administrative privileges or valid authentication.\nAttacker capabilities include the ability to establish numerous simultaneous TCP connections and manipulate data transmission rates.\nExploitation requirements involve sending network traffic over the network to the listening rsync port while bypassing standard I/O timeout enforcement.",
  "technicalDetails": "The root cause of the vulnerability lies in the handling of the initial handshake process by the rsync daemon.\nVulnerable components include the daemon connection management and timeout logic implemented prior to and immediately after module selection.\nAffected versions include all rsync daemon implementations from version 2.0.0 prior to version 3.5.0.\nThe vulnerability requires no authentication and can be exploited remotely over the network by unauthenticated attackers with zero privilege requirements.\nExploitation occurs when an attacker opens multiple simultaneous network connections to the target rsync daemon.\nBefore module selection takes place, no I/O timeout is applied by the daemon, allowing an attacker to stall the connection indefinitely.\nAfter module selection, attackers can trickle data at the absolute minimum required rate to prevent the I/O timeout mechanism from triggering and terminating the connection.\nBy maintaining these semi-dormant connections indefinitely, the attacker exhausts the maximum allowable daemon connection slots.\nPost-exploitation impact consists entirely of resource exhaustion, preventing any legitimate clients from establishing new connections or completing file synchronization operations."
}