CVE-2026-53800

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

• CVE-2026-53797: open the file the sender transmits through a descriptor resolved beneath the transfer root so a parent component raced into a symlink cannot redirect the read out of the tree
• CVE-2026-53798: reject an empty or non-numeric daemon name-converter reply instead of letting atol("") collapse it to uid/gid 0, and refuse control characters in the token sent to the converter
• CVE-2026-53799: pin the destination inode once in set_file_attrs() and set the ACLs, xattrs and mode through that descriptor so a leaf swapped after the content was written cannot redirect the metadata onto another file
• CVE-2026-53800: unlink a transferred source file through a descriptor held on its parent directory so --remove-source-files cannot be raced into removing a file outside the transfer root
• CVE-2026-53801: enumerate each source directory through a descriptor resolved beneath the transfer root and stat its entries through that descriptor so a parent raced into a symlink cannot make the scan list a directory outside the module

• CVE-2026-53801: prevent the sender from listing a directory outside the transfer through a path component swapped for a symlink
• CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way
• CVE-2026-53800: prevent --remove-source-files from deleting a file outside the transfer the same way

• CVE-2026-53801: prevent the sender from listing a directory outside the transfer through a path component swapped for a symlink
• CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way
• CVE-2026-53800: prevent --remove-source-files from deleting a file outside the transfer the same way

• CVE-2026-53801: extend the fix to the sender outside a daemon: prevent it from listing a directory outside the transfer through a path component swapped for a symlink
• CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way
• CVE-2026-53800: prevent --remove-source-files from deleting a file outside the transfer the same way

• CVE-2026-53801: extend the fix to the sender outside a daemon: prevent it from listing a directory outside the transfer through a path component swapped for a symlink
• CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way
• CVE-2026-53800: prevent --remove-source-files from deleting a file outside the transfer the same way

• CVE-2026-53801: extend the fix to the sender outside a daemon: prevent it from listing a directory outside the transfer through a path component swapped for a symlink
• CVE-2026-53797: prevent the sender from reading a file outside the transfer the same way
• CVE-2026-53800: prevent --remove-source-files from deleting a file outside the transfer the same way

Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code.

These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).