CVE-2026-70455 [HIGH] – rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote s

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the –zt short alias for –compress-threads, which bypasses the refuse options directive’s string matching on long option names. Attackers can specify –zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.