openrsync CVE-2025-67901
MEDIUMSeverity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Remotely reachable by a connected client (AV:N, PR:L); specifying a zero length is trivial so AC:L (lower than the input's AC:H); crash-only yields C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for block data, because the relationship between p->rem and p->len is not checked.
AnalysisAI
Server-side denial of service in openrsync through 0.5.0, including the copy shipped in OpenBSD through 7.8 and portable builds on other platforms, allows a client that has been accepted by the rsync server to crash the server process with a SIGSEGV. The attacker triggers the fault by specifying a block length of zero during the block-data exchange phase, a state the receiver never validates against the remaining byte count; impact is limited to availability (C:N/I:N/A:H, medium severity at CVSS 3.1 base 5.3) with no code execution or data exposure. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and EPSS is low at 0.28% (19th percentile), so practical risk is concentrated in servers that accept rsync sessions from untrusted clients.
Technical ContextAI
openrsync is a clean-room, BSD-licensed reimplementation of the rsync file-synchronization protocol, maintained by Kristaps Dzonsons and bundled with OpenBSD (through 7.8) as a replacement for the GPL rsync. The bug lives in the server-side block-data parsing path: the wire protocol transmits file data as blocks preceded by length fields, and the parser tracks the number of bytes left in the current input buffer (p->rem) alongside the length requested for the next block (p->len). The code at usr.bin/rsync/blocks.c lines 480-481, as referenced in the OpenBSD source tree, does not verify the relationship between those two values, so a client that advertises a block length of zero drives the parser into an inconsistent state that ends in a segmentation fault. This maps to CWE-1284 (Improper Validation of Specified Quantity in Input), the class of defects where an externally supplied size or count is consumed without bounds or consistency checks. Note that the supplied metadata tags this entry as "Information Disclosure," which is inconsistent with both the published vector and our independent assessment: the CVSS:3.1 vector sets C:N/I:N with A:H, confirming that only the availability of the server process is affected, and the attack requires an already established connection and reaching the block-data phase. The published vector uses AC:H and our independent assessment uses AC:L, but both agree on the availability-only impact profile and on PR:L, meaning the attacker must be an accepted rsync client rather than an anonymous network actor.
Affected ProductsAI
openrsync versions through 0.5.0 are affected, which covers the openrsync implementation as shipped in OpenBSD through release 7.8 as well as portable openrsync packages built for other platforms; the upstream tracking issue is kristapsdz/openrsync issue 34 (https://github.com/kristapsdz/openrsync/issues/34) and the vulnerable logic can be seen in the OpenBSD source tree at usr.bin/rsync/blocks.c lines 480-481 (commit 60b9c3dff1abf933e85e3c4d96b54201ee947513, https://github.com/openbsd/src/blob/60b9c3dff1abf933e85e3c4d96b54201ee947513/usr.bin/rsync/blocks.c#L480-L481). No CPE strings were supplied with the intelligence, so exact product/version enumeration beyond "openrsync <= 0.5.0" and "OpenBSD <= 7.8" cannot be independently confirmed. Systems running a different rsync implementation (for example GNU/Samba rsync) or openrsync versions later than 0.5.0 are not covered by this advisory and are considered unaffected based on the available data.
RemediationAI
No vendor-released patch was identified in the provided intelligence at time of analysis; the only upstream artifacts are the openrsync issue tracker entry (https://github.com/kristapsdz/openrsync/issues/34) and the vulnerable source reference, and no fixed release version is cited, so version numbers should not be assumed. Until a fix ships, the most effective control is exposure reduction: since the vulnerability requires an accepted rsync client session (PR:L, AC:L/AC:H), bind the daemon only to trusted networks, firewall TCP port 873 (and any non-standard rsync port), and restrict which client hosts and credentials are permitted to reach the block-data exchange phase; the trade-off is that legitimate remote synchronization from outside the allowlist must move to another channel. Where feasible, replace the openrsync server with a different, unaffected implementation (for example GNU/Samba rsync) for the same data sets, noting that behavior and flag compatibility may differ slightly. Running the daemon under a supervisor with automatic restart and connection rate limiting keeps the service available after a crash but does not prevent the DoS condition and can mask repeated attack attempts, so it should be combined with alerting on SIGSEGV events and rsync child-process failures so that repeated zero-length block submissions are detected and the offending client is blocked at the network layer; none of these compensating controls fix the missing p->rem/p->len validation, and they should be replaced by the vendor patch as soon as one is published.
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or e
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today