CVE-2026-29518

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)

• rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)

Bug Fix(es) and Enhancement(s):

• Rebase rsync to version 3.4.4 in Rocky Linux10 (JIRA:Rocky Linux-181630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)

• rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)

• rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
• rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)

Bug Fix(es) and Enhancement(s):

• Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
• rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
• rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

• CVE-2026-29518: fix daemon-no-chroot sender TOCTOU symlink race by opening source files via secure_relative_open() from module root

• SECURITY UPDATE: daemon-no-chroot TOCTOU symlink race
  • debian/patches/CVE-2026-29518.patch: track per-module chroot in am_chrooted and use_secure_symlinks; route the sender's read-path open, the receiver's basis-file open, mkstemp, and inplace write through secure_relative_open() / secure_mkstemp()
  • CVE-2026-29518

• SECURITY UPDATE: daemon-no-chroot TOCTOU symlink race
  • debian/patches/CVE-2026-29518.patch: track per-module chroot in am_chrooted and use_secure_symlinks; route the sender's read-path open, the receiver's basis-file open, mkstemp, and inplace write through secure_relative_open() / secure_mkstemp()
  • CVE-2026-29518

• CVE-2026-29518: fix daemon-no-chroot TOCTOU symlink race by tracking per-module chroot in am_chrooted, routing sender read-path, receiver basis-file open, mkstemp, and inplace write through secure_relative_open() / secure_mkstemp()

• CVE-2026-29518: fix TOCTOU symlink race in daemon file handling exposed when "use chroot = no"

• CVE-2026-29518: fix TOCTOU symlink race in daemon file handling exposed when "use chroot = no"

• CVE-2026-29518: fix TOCTOU symlink race in daemon file handling exposed when "use chroot = no"

• CVE-2026-29518: fix sender read-path TOCTOU by routing the daemon open through secure_relative_open() from the trusted module_dir root

• CVE-2026-43618: fix integer overflow in compressed-token decoding that could leak rsync process memory contents over the wire
• CVE-2026-29518: fix TOCTOU race on parent path components in non-chroot daemon by routing receiver/sender opens, chmod, and chdir through per- component O_NOFOLLOW secure variants gated on use_secure_symlinks

• CVE-2026-43618: fix integer overflow in compressed-token decoding that could leak rsync process memory contents over the wire
• CVE-2026-29518: fix TOCTOU race on parent path components in non-chroot daemon by routing receiver/sender opens, chmod, and chdir through per- component O_NOFOLLOW secure variants gated on use_secure_symlinks

• SECURITY UPDATE: receiver process memory disclosure via compressed-token integer overflow:
  • debian/patches/els/0004-CVE-2026-43618.patch: cap rx_token at MAX_TOKEN_INDEX; reject out-of-range token values.
  • CVE-2026-43618.
• SECURITY UPDATE: malicious server can enumerate arbitrary client files via crafted checksum responses:
  • debian/patches/els/0005-CVE-2024-12086.patch: add secure_relative_open() and route the receiver's basis-file open through it.
  • CVE-2024-12086.
• SECURITY UPDATE: daemon TOCTOU symlink race on parent path components when "use chroot = no":
  • debian/patches/els/0006-CVE-2026-29518.patch: gate sender/receiver opens and chmods through secure_relative_open() / do_chmod_at().
  • CVE-2026-29518.

• CVE-2026-29518: fix daemon-no-chroot TOCTOU on parent path components by routing both the sender read-path (sender.c) and the receiver write-path (receiver.c open_tmpfile and recv_files inplace branch) through secure_relative_open() / secure_mkstemp() from the trusted module root, and add regression test (chdir-symlink-race.test case 4)

• Add .bs_config for centos8.4els platform (mock dist .el8_4)
• CVE-2026-29518: fix daemon-no-chroot TOCTOU symlink race by tracking per-module chroot in am_chrooted, routing sender read-path, receiver basis-file open, mkstemp, and inplace write through secure_relative_open() / secure_mkstemp()

• PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050)
  • the daemon's compile-time NOBODY_GROUP was resolved to "nobody" by the focal build chroot's /etc/group, but stock Ubuntu/Debian have only "nogroup", so daemon modules with no explicit gid were rejected with "@ERROR: invalid gid nobody" (test_daemon / ELSR-8050)
  • debian/rules: build with rsync's own --with-nobody-group=nogroup configure option so the compile-time NOBODY_GROUP default is baked as "nogroup" regardless of the build chroot, matching the stock Ubuntu/Debian rsync build (fixes modules with no explicit gid)
  • debian/patches/rsync-daemon-nobody-group-fallback.patch: in the daemon's add_a_group() resolve a "nobody" group to "nogroup" at runtime when the host has no "nobody" group, so a module that explicitly sets "gid = nobody" is also honoured on stock Ubuntu/Debian instead of being rejected with "@ERROR: invalid gid nobody"; any other unresolvable group is still rejected
  • upstream: configure.ac AC_ARG_WITH(nobody-group) https://github.com/RsyncProject/rsync/blob/v3.1.3/configure.ac#L142-L157 Debian bugs #144570 (https://bugs.debian.org/144570) and #25299
  • ELSR-8050

• SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in add_implied_include() from a files-from entry carrying both an interior and a trailing backslash:
  • debian/patches/els/0009-CVE-2026-70461.patch: count a trailing backslash when sizing the appended-wildcard pattern.
  • CVE-2026-70461.
• SECURITY UPDATE: heap out-of-bounds write in read_args() when the peer's argument count lands exactly on the argv allocation:
  • debian/patches/els/0010-CVE-2026-70456.patch: reserve room for the trailing NULL terminator.
  • CVE-2026-70456.
• SECURITY UPDATE: out-of-bounds write from a file entry marked FLAG_HLINKED that the receiver accepted with hard-link preservation inactive:
  • debian/patches/els/0011-CVE-2026-70458.patch: gate FLAG_HLINKED on preserve_hard_links and exclude directories.
  • CVE-2026-70458.
• SECURITY UPDATE: sender-side out-of-bounds read driven by a malicious receiver's checksum header with a non-zero block count and a zero block length:
  • debian/patches/els/0012-CVE-2026-53792.patch: reject a zero block length in read_sum_head().
  • CVE-2026-53792.
• SECURITY UPDATE: CPU exhaustion in the sending process via quadratic-time behaviour in hash_search(), driven by a malicious receiver's crafted equal-weak-checksum block list. The attacker is the receiver, but the cycles burned are the sender's: hash_search() is reached only through match_sums(), whose sole caller is send_files() in sender.c. NVD's text attributes the CPU to the receiver; the direction stated here is what the code does:
  • debian/patches/els/0013-CVE-2026-70453.patch: bound the per-offset chain walk.
  • CVE-2026-70453.
• SECURITY UPDATE: daemon "hosts deny" failing open when a configured hostname token cannot be resolved:
  • debian/patches/els/0014-CVE-2026-70452.patch: treat an unresolvable deny-list token as a match.
  • CVE-2026-70452.
• SECURITY UPDATE: daemon "auth users" ignoring its documented comma-only parsing, silently discarding a deny rule that names a group whose name contains a space:
  • debian/patches/els/0015-CVE-2026-70463.patch: parse the list with conf_strtok().
  • CVE-2026-70463.
• SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT disabling the client's own I/O timeout through a non-positive or overflowing value:
  • debian/patches/els/0016-CVE-2026-70462.patch: cap the received value and make set_io_timeout() arithmetic overflow-safe.
  • CVE-2026-70462.
• SECURITY UPDATE: client-supplied --filter merge file bypassing the daemon module filter list:
  • debian/patches/els/0017-CVE-2026-53786.patch: strip the module-dir prefix before the daemon-filter check.
  • CVE-2026-53786.
• SECURITY UPDATE: per-connection daemon child crash on a crafted first incremental file list whose transfer root is a non-directory dot entry:
  • debian/patches/els/0018-CVE-2026-70459.patch: reject a non-directory transfer-root entry and require a dir_flist entry before trusting parent_ndx 0.
  • CVE-2026-70459.
• SECURITY UPDATE: malicious sender widening the receiver's --delete scope beyond the destination subtree via implied-parent reclassification:
  • debian/patches/els/0019-CVE-2026-53789.patch: force implied-parent directories non-content on the receiver, including the synthetic transfer root and the pre-protocol-30 encoding.
  • CVE-2026-53789.
• SECURITY UPDATE: unauthenticated pre-transfer handshake stall holding a per-connection daemon child past the module's max connections limit:
  • debian/patches/els/0020-CVE-2026-70464.patch: bound every peer-controlled handshake read with an absolute deadline and cap the early-protocol argument count.
  • CVE-2026-70464.
• SECURITY UPDATE: command and argument injection…

• SECURITY UPDATE: Destination-tree escape via symlink following in --relative implied-parent handling
  • debian/patches/CVE-2026-53785.patch: resolve the receiver's destination names one component at a time with O_NOFOLLOW|O_DIRECTORY, acting against a directory fd that is held open, instead of handing the whole name to the kernel to resolve; a component that is a symlink is now refused rather than traversed, so nothing the receiver creates lands at the symlink's target outside the destination tree; adds secure_relative_dirfd(), do_mkdir_at(), do_stat_at(), do_open_at(), do_rename_at(), do_symlink_at(), do_mknod_at() and do_link_at() in syscall.c and routes every way the receiver creates something at a destination name through them -- make_path() in util.c, the four implied-parent sites in generator.c, the install-into-final-name renames in util.c, rsync.c, receiver.c and generator.c, copy_file()'s reopen of the destination on the cross-filesystem fallback, the symlink and mknod creations in generator.c's atomic_create(), and the --link-dest and -H hard links in generator.c and hlink.c; each of those is its own route to the destination name, reached by a different option (--temp-dir bypasses the file create entirely, --devices / --specials and a transferred symlink never touch it, and --link-dest installs a regular file's link from hlink.c but a non-regular file's from generator.c), so confining only some of them leaves the escape open; extends the existing secure_mkstemp() and secure_relative_open() receiver create paths, which the CVE-2026-29518 fix gated on daemon-no-chroot only, to the same confinement; the confinement covers a chrooted daemon serving an inner-module "/./" boundary, whose module root the kernel chroot does not confine, and exempts --keep-dirlinks only for a local receiver, whose documented purpose is to follow a symlinked destination directory -- never for a daemon or for the server side of a push, where the option arrives from the peer; only the confinement this CVE needs is carried, not upstream's whole-tree dirfd-stack resolver, which assumes a source layout this version does not have; defines am_daemon, am_chrooted, am_server, local_server and keep_dirlinks in t_stub.c, which the standalone test harnesses link in place of options.c and main.c, so debian/rules' check target still builds; and adds testsuite/cve-2026-53785.test
  • CVE-2026-53785

• CVE-2026-53790: refuse a shell-active RSYNC_CONNECT_PROG %H host and quote it; escape backtick, newline and carriage return in remote-shell arguments
• CVE-2026-53793: confine a "/./" inner-module chroot: secure opens, change_dir, chmod, rename, delta-basis opens and alt-dest basis stats, resolved with an in-tree-symlink-following walk so in-module symlinks and --link-dest=../dir keep working; also sanitize a fuzzy-basis xname on the client
• CVE-2026-70453: cap the per-offset hash_search() chain walk at MAX_CHAIN_LEN
• CVE-2026-70458: refuse FLAG_HLINKED without -H or on a directory, and skip the checksum basis match for a non-regular hard-linked entry
• CVE-2026-70464: bound the daemon's pre-transfer handshake reads with an absolute deadline and cap daemon argument lists
• CVE-2026-29518: rebuild the module-relative path for the daemon sender's confined open, fixing "file has vanished" for a file fetched by name from a subdirectory of a "use chroot = no" module

• CVE-2026-53790: refuse a shell-active RSYNC_CONNECT_PROG %H host and quote it; escape backtick, newline and carriage return in remote-shell arguments
• CVE-2026-53793: confine a "/./" inner-module chroot: secure opens, change_dir, chmod, rename, delta-basis opens and alt-dest basis stats, resolved with an in-tree-symlink-following walk so in-module symlinks and --link-dest=../dir keep working; also sanitize a fuzzy-basis xname on the client
• CVE-2026-70453: cap the per-offset hash_search() chain walk at MAX_CHAIN_LEN
• CVE-2026-70458: refuse FLAG_HLINKED without -H or on a directory, and skip the checksum basis match for a non-regular hard-linked entry
• CVE-2026-70464: bound the daemon's pre-transfer handshake reads with an absolute deadline and cap daemon argument lists
• CVE-2026-29518: rebuild the module-relative path for the daemon sender's confined open, fixing "file has vanished" for a file fetched by name from a subdirectory of a "use chroot = no" module

• CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the *at() calls. In-module symlinks, directories the daemon uid may search but not read, -L/-K and --link-dest=../dir keep working; xattrs, ACLs and timestamps are confined too. Drop CVE-2026-29518-2.patch
• CVE-2026-43619: chmod no longer follows a leaf symlink; CVE-2026-29518: confined calls act on the resolved object with O_NOFOLLOW
• CVE-2026-29518: anchor the receiver's basis open at the pinned working directory and prove it beneath the module, not beneath a root resolved by name
• CVE-2026-53784, CVE-2026-53786, CVE-2026-53793: re-anchor on the re-implemented CVE-2026-29518 confinement

• CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the *at() calls. In-module symlinks, directories the daemon uid may search but not read, -L/-K and --link-dest=../dir keep working; xattrs, ACLs and timestamps are confined too. Drop CVE-2026-29518-2.patch
• CVE-2026-43619: chmod no longer follows a leaf symlink; CVE-2026-29518: confined calls act on the resolved object with O_NOFOLLOW
• CVE-2026-29518: anchor the receiver's basis open at the pinned working directory and prove it beneath the module, not beneath a root resolved by name
• CVE-2026-53784, CVE-2026-53786, CVE-2026-53793: re-anchor on the re-implemented CVE-2026-29518 confinement

The updated package fixes security vulnerabilities: Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. (CVE-2026-29518) Rsync < 3.4.3 Authorization Bypass via Hostname Resolution. (CVE-2026-43617) Rsync < 3.4.3 Integer Overflow Information Disclosure. (CVE-2026-43618) Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls. (CVE-2026-43619) Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files(). (CVE-2026-43620) Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy. (CVE-2026-45232)

These are all security issues fixed in the rsync-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rsync fixes the following issues

• CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
• CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

Security issues:

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Non security issues:

• rsync --delay-updates never updates after interruption (bsc#1204538).
• Fix duplication of flag causing illegal hashkey failures.

This update for rsync fixes the following issues

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
• CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues

• CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
• CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
• CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
• CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
• CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
• CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

This update for rsync fixes the following issues:

• CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
• CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).