Every CVE Search/ Get API key

CVE-2026-70455

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

8.7 HighFix available

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.57%Up 0.1 points since Aug 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
CVE-2026-70455
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-58049 8.7

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
EUVD-2026-58049
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.7

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
CVE-2026-70455
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2026-70455 8.7

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
ALPINE-CVE-2026-70455
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-70455 7.5
Record
BELL-CVE-2026-70455
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 8.7

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
CVE-2026-70455
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-770
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2026-70455 8.7

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
DEBIAN-CVE-2026-70455
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:67463 8.2

Red Hat Security Advisory: rsync security, bug fix, and enhancement update

Record
RHSA-2026:67463
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67463 8.2

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

  • rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)

  • rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

  • rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

  • rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

  • rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

  • rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

  • rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

  • rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)

  • rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

  • rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

  • rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

  • rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

  • rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

  • rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

  • rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)

  • rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

  • rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

  • rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

  • rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

  • rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

  • Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67463
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-70455 8.7

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
UBUNTU-CVE-2026-70455
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:67463 No score

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
  • rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
  • rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
  • rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
  • rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
  • rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
  • rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
  • rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
  • rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
  • rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
  • rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
  • rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
  • rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
  • rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
  • rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
  • rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
  • rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
  • rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
  • rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
  • rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
  • rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

  • Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67463
Updated
2026-11-02
OSVAZL-95807 No score

CVE-2026-70455 affecting package rsync for versions less than 3.5.0-1

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Record
AZL-95807
Updated
2026-11-02
OSVMGASA-2026-0487 No score

Updated rsync package fixes security vulnerabilities

Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code.

Record
MGASA-2026-0487
Updated
2026-11-02
OSVopenSUSE-SU-2026:11869-1 No score

rsync-3.5.1-1.1 on GA media

These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11869-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21650-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
openSUSE-SU-2026:21650-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-70455 No score

CVE-2026-70455 in rsync - Patched by Root

Root has patched CVE-2026-70455 in the rsync package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-70455
Updated
2026-11-02
OSVSUSE-SU-2026:23253-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23253-1
Updated
2026-11-02
OSVSUSE-SU-2026:23254-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23254-1
Updated
2026-11-02
OSVSUSE-SU-2026:23289-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23289-1
Updated
2026-11-02
OSVSUSE-SU-2026:23323-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23323-1
Updated
2026-11-02
OSVSUSE-SU-2026:3634-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:3634-1
Updated
2026-11-02
OSVSUSE-SU-2026:3657-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:3657-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rsync
Alpine:v3.21
 3.4.2 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.22
 3.4.2 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.23
 3.4.2 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.24
 3.4.2 up to 3.5.0-r0
3.5.0-r0
rsync
AlmaLinux:10
From an advisory covering 21 CVEs
 before 3.5.0-3.el10_2
3.5.0-3.el10_2
rsync-daemon
AlmaLinux:10
From an advisory covering 21 CVEs
 before 3.5.0-3.el10_2
3.5.0-3.el10_2
rsync-rrsync
AlmaLinux:10
From an advisory covering 21 CVEs
 before 3.5.0-3.el10_2
3.5.0-3.el10_2
rsync
Azure Linux:3
 before 3.5.0-1
3.5.0-1
rsync
Alpaquita:23
 3.2.7-r0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpaquita:25
 3.4.1-r0 up to 3.5.0-r0
3.5.0-r0
Show 42 moreShow less
Affected packages
PackageAffectedFixed
rsync
Alpaquita:stream
 3.2.5-r0 up to 3.5.0-r0
3.5.0-r0
rsync
Debian:12
 All versions, plus listed versions
3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u33.2.7-1+deb12u4
Show 28 moreShow less
3.2.7-1+deb12u53.2.7-1+deb12u63.3.0+ds1-13.3.0+ds1-23.3.0+ds1-33.3.0+ds1-43.3.0-13.4.1+ds1-13.4.1+ds1-23.4.1+ds1-33.4.1+ds1-43.4.1+ds1-4~exp13.4.1+ds1-4~exp23.4.1+ds1-53.4.1+ds1-5~exp13.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-13.5.0+ds1-13.5.0+ds1-23.5.0+ds1-33.5.1+ds1-13.5.1+ds1-2
 None known
rsync
Debian:13
 before 3.5.0+ds1-0+deb13u1, plus listed versions
3.4.1+ds1-53.4.1+ds1-5+deb13u13.4.1+ds1-5+deb13u23.4.1+ds1-5+deb13u33.4.1+ds1-5+deb13u4
Show 8 moreShow less
3.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-1
3.5.0+ds1-0+deb13u1
rsync
Debian:14
 before 3.5.0+ds1-1, plus listed versions
3.4.1+ds1-53.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-1
Show 4 moreShow less
3.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-1
3.5.0+ds1-1
rsync
Mageia:10
From an advisory covering 33 CVEs
 before 3.5.1-1.mga10
3.5.1-1.mga10
rsync-daemon
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync-rrsync
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync
Rocky Linux:10
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync
Root:Debian:11
 before 3.2.3-4+deb11u4.aikido.2
3.2.3-4+deb11u4.aikido.23.2.3-4+deb11u4.aikido.3
rootio-rsync
Root:Debian:11
 before 3.2.3-4+deb11u4.aikido.2
3.2.3-4+deb11u4.aikido.23.2.3-4+deb11u4.aikido.3
rsync
SUSE:Linux Micro 6.0
From an advisory covering 37 CVEs
 before 3.2.7-8.1
3.2.7-8.1
rsync
SUSE:Linux Micro 6.1
From an advisory covering 33 CVEs
 before 3.3.0-slfo.1.1_7.1
3.3.0-slfo.1.1_7.1
rsync
SUSE:Linux Micro 6.2
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.3
Show 5 moreShow less
3.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm23.1.0-2ubuntu0.4+esm33.1.0-2ubuntu0.4+esm4
 None known
rsync
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3
Show 6 moreShow less
3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm43.1.1-3ubuntu1.3+esm53.1.1-3ubuntu1.3+esm6
 None known
rsync
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2
Show 8 moreShow less
3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm23.1.2-2.1ubuntu1.6+esm33.1.2-2.1ubuntu1.6+esm4
 None known
rsync
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
Show 7 moreShow less
3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.93.1.3-8ubuntu0.9+esm13.1.3-8ubuntu0.9+esm2
 None known
rsync
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3
Show 6 moreShow less
3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.43.2.7-0ubuntu0.22.04.63.2.7-0ubuntu0.22.04.7
 None known
rsync
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.23.2.7-1ubuntu1.43.2.7-1ubuntu1.5
 None known
rsync
Ubuntu:26.10
 All versions, plus listed versions
3.4.1+ds1-73.4.4+ds1-13.4.4+ds1-1build13.5.0+ds1-2
 None known
rsync
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-73.4.1+ds1-7ubuntu0.23.4.1+ds1-7ubuntu0.3
 None known
rsync
openSUSE:Tumbleweed
From an advisory covering 37 CVEs
 before 3.5.1-1.1
3.5.1-1.1
rsync
openSUSE:Leap 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, published, referencesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-70455 is a high vulnerability (CVSS 8.7) in Rsyncproject Rsync, published August 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in rsync 3.5.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 49 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open