alpine-cve-2026-70462

CVSS 7.1 osv_alpine
Description

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70462.json"
      },
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.21",
        "name": "rsync",
        "purl": "pkg:apk/alpine/rsync?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.5.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70462.json"
      },
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.22",
        "name": "rsync",
        "purl": "pkg:apk/alpine/rsync?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.5.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70462.json"
      },
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.23",
        "name": "rsync",
        "purl": "pkg:apk/alpine/rsync?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.5.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-70462.json"
      },
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "Alpine:v3.24",
        "name": "rsync",
        "purl": "pkg:apk/alpine/rsync?arch=source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.5.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.",
  "id": "ALPINE-CVE-2026-70462",
  "modified": "2026-11-04T09:30:02.943948189Z",
  "published": "2026-08-13T15:20:00.267Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security.alpinelinux.org/vuln/CVE-2026-70462"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "upstream": [
    "CVE-2026-70462"
  ]
}
View JSON API Download JSON