Every CVE Search/ Get API key

CVE-2026-70457

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

8.3 HighFix available

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.38%Unchanged since Aug 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.3

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
CVE-2026-70457
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-131, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-58047 8.3

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
EUVD-2026-58047
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.3

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
CVE-2026-70457
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-131, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2026-70457 8.2

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
ALPINE-CVE-2026-70457
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-70457 8.2
Record
BELL-CVE-2026-70457
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSV 8.3

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
CVE-2026-70457
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-131, CWE-787
Updated
2026-11-02
Show 23 moreShow less
OSVDEBIAN-CVE-2026-70457 8.2

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
DEBIAN-CVE-2026-70457
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVOESA-2026-3949 9.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Record
OESA-2026-3949
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-3950 9.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Record
OESA-2026-3950
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-4072 9.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Record
OESA-2026-4072
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:67462 8.2

Red Hat Security Advisory: rsync security, bug fix, and enhancement update

Record
RHSA-2026:67462
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67463 8.2

Red Hat Security Advisory: rsync security, bug fix, and enhancement update

Record
RHSA-2026:67463
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67462 8.2

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

  • rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)

  • rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

  • rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

  • rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

  • rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

  • rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

  • rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

  • rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)

  • rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

  • rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

  • rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

  • rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

  • rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

  • rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

  • rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

  • rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

  • rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

  • rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

  • rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

  • Rebase rsync to version 3.2.7 in Rocky Linux9 (JIRA:Rocky Linux-248835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67462
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67463 8.2

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

  • rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)

  • rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

  • rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

  • rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

  • rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

  • rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

  • rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

  • rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)

  • rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

  • rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

  • rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

  • rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

  • rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

  • rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

  • rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)

  • rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

  • rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

  • rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

  • rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

  • rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

  • Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67463
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-70457 8.3

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
UBUNTU-CVE-2026-70457
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVALSA-2026:67462 No score

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
  • rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
  • rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
  • rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
  • rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
  • rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
  • rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
  • rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
  • rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
  • rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
  • rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
  • rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
  • rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
  • rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
  • rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
  • rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
  • rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
  • rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
  • rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
  • rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

  • Rebase rsync to version 3.2.7 in AlmaLinux9 (JIRA:AlmaLinux-248835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67462
Updated
2026-11-02
OSVALSA-2026:67463 No score

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
  • rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
  • rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
  • rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
  • rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
  • rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
  • rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
  • rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
  • rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
  • rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
  • rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
  • rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
  • rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
  • rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
  • rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
  • rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
  • rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
  • rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
  • rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
  • rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
  • rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

  • Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67463
Updated
2026-11-02
OSVAZL-95846 No score

CVE-2026-70457 affecting package rsync for versions less than 3.5.0-1

rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.

Record
AZL-95846
Updated
2026-11-02
OSVCLSA-2026-1788433791 No score

rsync: Fix of 3 CVEs

  • CVE-2026-53789: force implied-parent directories to non-content on the receiver so a malicious sender cannot widen --delete scope
  • CVE-2026-70459: reject a non-directory transfer-root entry so a forged "." cannot drive a --force recursive delete of the destination
  • CVE-2026-70457: clamp the snprintf() length before the err_buf[len] writes in parse_size_arg() to stop an out-of-bounds .bss write
Record
CLSA-2026-1788433791
Updated
2026-11-02
OSVMGASA-2026-0487 No score

Updated rsync package fixes security vulnerabilities

Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code.

Record
MGASA-2026-0487
Updated
2026-11-02
OSVopenSUSE-SU-2026:11869-1 No score

rsync-3.5.1-1.1 on GA media

These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11869-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21650-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
openSUSE-SU-2026:21650-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-70457 No score

CVE-2026-70457 in rsync - Patched by Root

Root has patched CVE-2026-70457 in the rsync package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-70457
Updated
2026-11-02
OSVSUSE-SU-2026:23253-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23253-1
Updated
2026-11-02
OSVSUSE-SU-2026:23254-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23254-1
Updated
2026-11-02
OSVSUSE-SU-2026:23289-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23289-1
Updated
2026-11-02
OSVSUSE-SU-2026:23323-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23323-1
Updated
2026-11-02
OSVSUSE-SU-2026:3634-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:3634-1
Updated
2026-11-02
OSVSUSE-SU-2026:3657-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:3657-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rsync
Alpine:v3.21
 3.2.3 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.22
 3.2.3 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.23
 3.2.3 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.24
 3.2.3 up to 3.5.0-r0
3.5.0-r0
rsync
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.2.7-1.el9_8
3.2.7-1.el9_8
rsync-daemon
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.2.7-1.el9_8
3.2.7-1.el9_8
rsync-rrsync
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.2.7-1.el9_8
3.2.7-1.el9_8
rsync
AlmaLinux:10
From an advisory covering 21 CVEs
 before 3.5.0-3.el10_2
3.5.0-3.el10_2
rsync-daemon
AlmaLinux:10
From an advisory covering 21 CVEs
 before 3.5.0-3.el10_2
3.5.0-3.el10_2
rsync-rrsync
AlmaLinux:10
From an advisory covering 21 CVEs
 before 3.5.0-3.el10_2
3.5.0-3.el10_2
Show 56 moreShow less
Affected packages
PackageAffectedFixed
rsync
Azure Linux:3
 before 3.5.0-1
3.5.0-1
rsync
Alpaquita:23
 3.2.7-r0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpaquita:25
 3.4.1-r0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpaquita:stream
 3.2.5-r0 up to 3.5.0-r0
3.5.0-r0
rsync
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.2.3-19.el9_2.tuxcare.els12
3.2.3-19.el9_2.tuxcare.els12
rsync-daemon
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 3.2.3-19.el9_2.tuxcare.els12
3.2.3-19.el9_2.tuxcare.els12
rsync
Debian:12
 All versions, plus listed versions
3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u33.2.7-1+deb12u4
Show 28 moreShow less
3.2.7-1+deb12u53.2.7-1+deb12u63.3.0+ds1-13.3.0+ds1-23.3.0+ds1-33.3.0+ds1-43.3.0-13.4.1+ds1-13.4.1+ds1-23.4.1+ds1-33.4.1+ds1-43.4.1+ds1-4~exp13.4.1+ds1-4~exp23.4.1+ds1-53.4.1+ds1-5~exp13.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-13.5.0+ds1-13.5.0+ds1-23.5.0+ds1-33.5.1+ds1-13.5.1+ds1-2
 None known
rsync
Debian:13
 before 3.5.0+ds1-0+deb13u1, plus listed versions
3.4.1+ds1-53.4.1+ds1-5+deb13u13.4.1+ds1-5+deb13u23.4.1+ds1-5+deb13u33.4.1+ds1-5+deb13u4
Show 8 moreShow less
3.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-1
3.5.0+ds1-0+deb13u1
rsync
Debian:14
 before 3.5.0+ds1-1, plus listed versions
3.4.1+ds1-53.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-1
Show 4 moreShow less
3.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-1
3.5.0+ds1-1
rsync
Mageia:10
From an advisory covering 33 CVEs
 before 3.5.1-1.mga10
3.5.1-1.mga10
rsync
openEuler:24.03-LTS-SP1
From an advisory covering 33 CVEs
 before 3.2.7-12.oe2403sp1
3.2.7-12.oe2403sp1
rsync
openEuler:24.03-LTS-SP3
From an advisory covering 33 CVEs
 before 3.2.7-12.oe2403sp3
3.2.7-12.oe2403sp3
rsync
openEuler:24.03-LTS-SP4
From an advisory covering 33 CVEs
 before 3.2.7-12.oe2403sp4
3.2.7-12.oe2403sp4
rsync-daemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.2.7-1.el9_8
0:3.2.7-1.el9_8
rsync-rrsync
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.2.7-1.el9_8
0:3.2.7-1.el9_8
rsync
Red Hat:enterprise_linux:9::baseos
From an advisory covering 20 CVEs
 before 0:3.2.7-1.el9_8
0:3.2.7-1.el9_8
rsync-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 20 CVEs
 before 0:3.2.7-1.el9_8
0:3.2.7-1.el9_8
rsync-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 20 CVEs
 before 0:3.2.7-1.el9_8
0:3.2.7-1.el9_8
rsync-daemon
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync-rrsync
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:3.2.7-1.el9_8
0:3.2.7-1.el9_8
rsync
Rocky Linux:10
From an advisory covering 21 CVEs
 before 0:3.5.0-3.el10_2
0:3.5.0-3.el10_2
rsync
Root:Debian:11
 before 3.2.3-4+deb11u4.aikido.2
3.2.3-4+deb11u4.aikido.23.2.3-4+deb11u4.aikido.3
rootio-rsync
Root:Debian:11
 before 3.2.3-4+deb11u4.aikido.2
3.2.3-4+deb11u4.aikido.23.2.3-4+deb11u4.aikido.3
rsync
SUSE:Linux Micro 6.0
From an advisory covering 37 CVEs
 before 3.2.7-8.1
3.2.7-8.1
rsync
SUSE:Linux Micro 6.1
From an advisory covering 33 CVEs
 before 3.3.0-slfo.1.1_7.1
3.3.0-slfo.1.1_7.1
rsync
SUSE:Linux Micro 6.2
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.3
Show 5 moreShow less
3.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm23.1.0-2ubuntu0.4+esm33.1.0-2ubuntu0.4+esm4
 None known
rsync
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3
Show 6 moreShow less
3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm43.1.1-3ubuntu1.3+esm53.1.1-3ubuntu1.3+esm6
 None known
rsync
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2
Show 8 moreShow less
3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm23.1.2-2.1ubuntu1.6+esm33.1.2-2.1ubuntu1.6+esm4
 None known
rsync
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
Show 7 moreShow less
3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.93.1.3-8ubuntu0.9+esm13.1.3-8ubuntu0.9+esm2
 None known
rsync
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3
Show 6 moreShow less
3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.43.2.7-0ubuntu0.22.04.63.2.7-0ubuntu0.22.04.7
 None known
rsync
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.23.2.7-1ubuntu1.43.2.7-1ubuntu1.5
 None known
rsync
Ubuntu:26.10
 All versions, plus listed versions
3.4.1+ds1-73.4.4+ds1-13.4.4+ds1-1build13.5.0+ds1-2
 None known
rsync
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-73.4.1+ds1-7ubuntu0.23.4.1+ds1-7ubuntu0.3
 None known
rsync
openSUSE:Tumbleweed
From an advisory covering 37 CVEs
 before 3.5.1-1.1
3.5.1-1.1
rsync
openSUSE:Leap 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, published, referencesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-70457 is a high vulnerability (CVSS 8.3) in Rsyncproject Rsync, published August 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in rsync 3.5.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 70 references and the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open