CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

• rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)

• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

• rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)

• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

• rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

• rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

• Rebase rsync to version 3.2.7 in Rocky Linux9 (JIRA:Rocky Linux-248835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

• rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)

• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

• rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)

• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

• rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

• rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)

• rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

• Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

• rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)

• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

• Fix latest CVEs in rsync in Rocky Linux8 (JIRA:Rocky Linux-256903)

• rsync-3.1.3-27.el8_10 regression: rsync daemon rejects legitimate cross-device symlinks with EXDEV when use chroot = no (JIRA:Rocky Linux-239553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
• rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
• rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
• rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
• rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

• Rebase rsync to version 3.2.7 in AlmaLinux9 (JIRA:AlmaLinux-248835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
• rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
• rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
• rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
• rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
• rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

• Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
• rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

• Fix latest CVEs in rsync in AlmaLinux8 (JIRA:AlmaLinux-256903)
• rsync-3.1.3-27.el8_10 regression: rsync daemon rejects legitimate cross-device symlinks with EXDEV when use chroot = no (JIRA:AlmaLinux-239553)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

• SECURITY UPDATE: symlink attacks on daemon operator-supplied paths
  • debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() in util.c and confine the daemon module-root chdir under use-chroot=no
  • CVE-2026-53784
• SECURITY UPDATE: information disclosure via planted symlinks
  • debian/patches/CVE-2026-53802-CVE-2026-53803.patch: open the secrets file, --password-file, batch, log, config and exclude/include files through safe_open_no_attacker_symlinks()
  • CVE-2026-53802
  • CVE-2026-53803
• SECURITY UPDATE: information disclosure via symlinked filter/merge files
  • debian/patches/CVE-2026-53786.patch: open filter and per-directory merge files through safe_open_no_attacker_symlinks() and treat a merge file hidden by the daemon filter as absent
  • CVE-2026-53786
• SECURITY UPDATE: arbitrary file write via absolute --temp-dir/--link-dest
  • debian/patches/CVE-2026-53795.patch: confine do_rename() and do_link() in syscall.c through an ownership walk on the pinned parent directory fd
  • CVE-2026-53795
• SECURITY UPDATE: daemon crash via a malformed file list entry
  • debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root entry and bound parent_ndx in flist.c, generator.c and receiver.c
  • CVE-2026-70459
• SECURITY UPDATE: "auth users" entries parsed on whitespace
  • debian/patches/CVE-2026-70463.patch: parse the daemon's "auth users" list with conf_strtok() in authenticate.c so it splits on commas alone
  • CVE-2026-70463
• The non-directory transfer-root guard shipped in +tuxcare.els5 under debian/patches/CVE-2026-53789.patch now lives in debian/patches/CVE-2026-70459.patch, no functional change
• The upstream regression tests named in the patch headers are not carried: upstream ships them only as pytest testsuite/*_test.py files and 3.1.3 has no pytest harness

• CVE-2026-53786: strip the module dir back off a --filter merge file path before the daemon_filter_list check so an anchored module-relative daemon rule matches and a hidden merge file cannot be pulled in
• CVE-2026-53795: confine each side of do_rename_at() and do_link_at() independently so an absolute --temp-dir or --link-dest cannot switch off confinement and redirect the final rename out of the destination tree
• CVE-2026-53802: route the secrets file, --password-file, the filter and merge files and --files-from through open_no_attacker_symlinks() and fstat the descriptor so a planted symlink cannot leak a root-readable file

• SECURITY UPDATE: daemon module-root chdir escape under use chroot = no
  • debian/patches/CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() to util.c and route change_dir()'s daemon module-root chdir through it, so a planted parent-component symlink no longer moves the daemon's CWD outside the module; a symlink is followed only when owned by uid 0 or our euid
  • CVE-2026-53784
• SECURITY UPDATE: arbitrary file read via symlinked operator input paths
  • debian/patches/CVE-2026-53802.patch: open --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/ --exclude-from (exclude.c) and the --password-file / daemon secrets file (authenticate.c) through the same ownership-checked walk, so a planted symlink cannot feed an arbitrary file to the filter parser or the authentication response
  • CVE-2026-53802
• SECURITY UPDATE: arbitrary file write via symlinked operator output paths
  • debian/patches/CVE-2026-53803.patch: open --log-file (log.c), the --write-batch/--read-batch files (batch.c and main.c) and the daemon motd, lock and --config paths (clientserver.c, connection.c, params.c) through the same ownership-checked walk, so a planted symlink cannot redirect a privileged write, and require --read-batch to name a regular file or a FIFO
  • CVE-2026-53803
• NOTE: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.

• CVE-2026-53784: daemon module-root chdir escape under use chroot = no because change_dir() reached the module path with a plain chdir(), which followed a planted parent-component symlink and served files from outside the module; the module-root chdir now resolves through an ownership-checked O_NOFOLLOW path walk
• CVE-2026-53802: arbitrary file read via symlinked operator-supplied input paths because --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/--exclude-from and the --password-file / daemon secrets file were opened by path, letting a planted symlink feed an arbitrary file to the filter parser or the authentication response; these now use the same ownership-checked path walk
• CVE-2026-53803: arbitrary file write via symlinked operator-supplied output paths because --log-file, --write-batch/--read-batch and the daemon motd, lock and --config opens resolved by path, letting a planted symlink redirect a privileged write; these now use the same ownership-checked path walk, and --read-batch additionally requires a regular file or a FIFO
• Note: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.

• CVE-2026-53784: daemon module-root chdir escape under use chroot = no because change_dir() reached the module path with a plain chdir(), which followed a planted parent-component symlink and served files from outside the module; the module-root chdir now resolves through an ownership-checked O_NOFOLLOW path walk
• CVE-2026-53802: arbitrary file read via symlinked operator-supplied input paths because --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/--exclude-from and the --password-file / daemon secrets file were opened by path, letting a planted symlink feed an arbitrary file to the filter parser or the authentication response; these now use the same ownership-checked path walk
• CVE-2026-53803: arbitrary file write via symlinked operator-supplied output paths because --log-file, --write-batch/--read-batch and the daemon motd, lock and --config opens resolved by path, letting a planted symlink redirect a privileged write; these now use the same ownership-checked path walk, and --read-batch additionally requires a regular file or a FIFO
• Note: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.

• CVE-2026-53802: arbitrary file read via symlinked operator-supplied input paths because --filter merge files (including per-directory merges and -C .cvsignore), --files-from/--include-from/--exclude-from and the --password-file / daemon secrets file were opened by path, letting a planted symlink feed an arbitrary file to the filter parser or the authentication response; these now use the same ownership-checked path walk
• CVE-2026-53803: arbitrary file write via symlinked operator-supplied output paths because --log-file, --write-batch/--read-batch and the daemon motd, lock and --config opens resolved by path, letting a planted symlink redirect a privileged write; these now use the same ownership-checked path walk, and --read-batch additionally requires a regular file or a FIFO
• Note: the ownership-checked path walk opens each intermediate directory for reading, where plain path resolution needed only search permission, so an operator path under a search-only (e.g. 0711) ancestor that the caller cannot read is now refused: --log-file falls back to syslog with a warning and --exclude-from fails. This matches upstream behaviour.

• CVE-2026-53784: resolve the daemon module-root chdir through a trusted-owner walk so a planted symlink on the module path or any parent component cannot steer the daemon outside the module under "use chroot = no"
• CVE-2026-53795: confine each side of do_rename_at()/do_link_at() independently; an absolute --temp-dir or --link-dest previously disabled confinement for the relative in-tree side as well
• CVE-2026-53802: resolve operator-supplied input files (--filter merge files, --files-from, --password-file, daemon secrets) through the trusted-owner walk so a planted symlink cannot be read as filter rules or as the auth response
• CVE-2026-53803: resolve operator-supplied output paths (--log-file, --write-batch/--read-batch, daemon motd/lock/early-input/--config) through the same walk, plus a regular-file-or-FIFO check on the --read-batch file

• SECURITY UPDATE: symlink attack on the daemon module-root chdir
  • debian/patches/els/0031-CVE-2026-53784.patch: add safe_open_no_attacker_symlinks() in util.c and confine the daemon module-root chdir under use-chroot=no. els/0006 had hardened only the relative branch of change_dir(); the absolute branch was still on a plain chdir(dir)
  • CVE-2026-53784
• SECURITY UPDATE: information disclosure and arbitrary write via symlinks planted on operator-supplied paths
  • debian/patches/els/0032-CVE-2026-53802-CVE-2026-53803.patch: open the secrets file, "pid file", --config, motd, --password-file, --log-file, --write-batch/--read-batch and the filter, merge-file, --exclude-from/--include-from paths through safe_open_no_attacker_symlinks()
  • debian/patches/els/0037-CVE-2026-53802-files-from.patch: the same for --files-from, which is opened in options.c and which upstream converted separately, in 3ee00e00
  • CVE-2026-53802
  • CVE-2026-53803
• SECURITY UPDATE: arbitrary file write via an absolute --temp-dir or --link-dest whose parent is flipped to a symlink mid-operation
  • debian/patches/els/0033-CVE-2026-53795.patch: confine do_rename() and do_link() in syscall.c through an ownership walk on the pinned parent directory fd
  • debian/patches/els/0039-CVE-2026-53795-exdev.patch: confine the same way the copy_file() opens and the do_unlink() that robust_rename() falls back to when the rename returns EXDEV, i.e. when an absolute --temp-dir or --partial-dir is on another filesystem (upstream bf79a2a0)
  • CVE-2026-53795
• These four CVEs were previously assessed as requiring the 3.5.0 path resolution rewrite (54965efc, defd7110, b62d7ed6) and closed Won't Fix. That assessment was wrong for CVE-2026-53784/53802/53803: upstream fixed them on 2026-06-12 in a7c49e93, f2941575, 9bfa07e3 and 62bf55fc, nine days before the rewrite and independent of it. CVE-2026-53795 does depend on the rewrite; els/0033 covers only the two sinks it names and documents what it leaves out
• SECURITY UPDATE: TOCTOU on the non-daemon receiver's destination chdir
  • debian/patches/els/0034-CVE-2026-53796.patch: resolve the operator-named destination through safe_open_no_attacker_symlinks() + fchdir, for both the absolute and the relative branch of change_dir()
  • CVE-2026-53796
• SECURITY UPDATE: path confinement bypass for a daemon module with a /./ inner boundary marker
  • debian/patches/els/0035-CVE-2026-53793.patch: widen the four daemon symlink-confinement gates from "am_daemon && !am_chrooted" to "am_daemon && (!am_chrooted || module_dirlen)" so an inner module root is treated as the trust boundary
  • debian/patches/els/0040-CVE-2026-53793-basis-paths.patch: extend that boundary to the two alternate-basis paths the gates do not reach -- the generator's alt-dest basis stat (upstream 5ed0ab3f) and the peer-supplied basis xname the receiver joins to an operator basedir (upstream db284e22)
  • CVE-2026-53793
• SECURITY UPDATE: symlink race in the non-daemon sender's source traversal
  • debian/patches/els/0036-CVE-2026-53797.patch: open file content through secure_relative_open() anchored at the transfer root under default symlink handling, so a raced parent symlink cannot redirect the read
  • debian/patches/els/0038-CVE-2026-53797-noatime.patch: apply O_NOATIME in secure_relative_open() as do_open() did, so --noatime keeps working on that open (and on the els/0006 daemon-sender one)
  • CVE-2026-53797
• The three above come from openSUSE's backport of the same upstream commits to rsync 3.2.3 (openSUSE:Leap:15.5:Update/rsync.45907, hardening patches 0108, 0107 and 0100). Four further CVEs from this disclosure remain open …

• CVE-2026-53802: open the daemon secrets file, the client --password-file, --files-from and the --filter merge / per-directory merge files refusing attacker-planted symlinks -- confined beneath the module root on a daemon, owner-trust walk otherwise; getpassf() fstat()s the opened fd, not the path

• CVE-2026-53802: open the daemon secrets file, the client --password-file, --files-from and the --filter merge / per-directory merge files refusing attacker-planted symlinks -- confined beneath the module root on a daemon, owner-trust walk otherwise; getpassf() fstat()s the opened fd, not the path

• CVE-2026-53802: open the daemon secrets file, the client --password-file, --files-from and the --filter merge / per-directory merge files refusing attacker-planted symlinks -- confined beneath the module root on a daemon, owner-trust walk otherwise; getpassf() fstat()s the opened fd, not the path

• CVE-2026-53783: harden the support/rrsync wrapper: refuse paths that resolve outside the restricted directory, refuse -L/-k/-K and --copy-unsafe-links there, hand the transfer arguments and the receiver's directory options to rsync as held directories, stop path arguments being parsed as options, open rrsync.log without following a symlink; add --drop-D so a restricted receiver does not create devices or special files, and --confine-root so rsync refuses names that leave the restricted directory, including --files-from lines and merge files
• CVE-2026-53802: open the daemon secrets file, the client --password-file, --files-from and the --filter merge / per-directory merge files refusing attacker-planted symlinks -- confined beneath the module root on a daemon, owner-trust walk otherwise; secrets and password files are checked with fstat() of the opened fd; /dev/fd, /dev/stdin and <(...) keep working

Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code.

These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

Root has patched CVE-2026-53802 in the rsync package for Root:Debian:11. Multiple fixed versions available.

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).

This update for rsync fixes the following issues:

• CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
• CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
• CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
• CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
• CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
• CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
• CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
• CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
• CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
• CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
• CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
• CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
• CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
• CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
• CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
• CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
• CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
• CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
• CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
• CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
• CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
• CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
• CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
• CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
• CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
• CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
• CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
• CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
• CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
• CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
• CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
• CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
• CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).