CVE-2026-70456

Publié : 13 août 2026

Modifié : 13 août 2026

Score CVSS

8.2

HIGH

Description détaillée

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Références et Patchs

https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args

Dernières Vulnérabilités

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

VOIR DÉTAILS

CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

VOIR DÉTAILS

CVE-2026-59763

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

VOIR DÉTAILS