CVE-2026-70464 is a denial of service vulnerability in the rsync daemon affecting versions from 2.0.0 through 3.4.4. The flaw allows unauthenticated remote attackers to consume all available connection slots by opening many simultaneous connections and stalling the handshake process either before or after module selection. Attackers can avoid triggering I/O timeouts by trickling data at minimal rates or stalling entirely before module selection where no timeout applies. This results in denial of service by preventing legitimate clients from establishing connections.

The vulnerability enables remote unauthenticated attackers to cause denial of service by exhausting all daemon connection slots, effectively blocking legitimate client access to the rsync service. There is no indication of data compromise or privilege escalation, but service availability is severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, consider limiting exposure of the rsync daemon to untrusted networks or implementing external connection throttling controls if possible.