Every CVE Search/ Get API key

CVE-2026-70462

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

7.1 HighFix available

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.29%Unchanged since Aug 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
CVE-2026-70462
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-190, CWE-835
Updated
2026-11-02
EUVDEUVD-2026-58042 7.1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
EUVD-2026-58042
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 7.1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
CVE-2026-70462
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-190, CWE-835
Updated
2026-11-04
OSVALPINE-CVE-2026-70462 7.1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
ALPINE-CVE-2026-70462
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-04
OSVBELL-CVE-2026-70462 6.5
Record
BELL-CVE-2026-70462
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.1

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
CVE-2026-70462
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190, CWE-835
Updated
2026-11-05
Show 23 moreShow less
OSVDEBIAN-CVE-2026-70462 7.1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
DEBIAN-CVE-2026-70462
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-04
OSVOESA-2026-3949 9.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Record
OESA-2026-3949
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-3950 9.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Record
OESA-2026-3950
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-4072 9.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.(CVE-2026-53783)

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.(CVE-2026-53784)

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.(CVE-2026-53785)

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.(CVE-2026-53786)

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.(CVE-2026-53788)

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and…

Record
OESA-2026-4072
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-70462 7.1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
UBUNTU-CVE-2026-70462
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-95840 No score

CVE-2026-70462 affecting package rsync for versions less than 3.5.0-1

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

Record
AZL-95840
Updated
2026-11-02
OSVCLSA-2026-1788335736 No score

Fix of 13 CVEs

  • SECURITY UPDATE: peer-driven one-byte heap out-of-bounds write in add_implied_include() from a files-from entry carrying both an interior and a trailing backslash:
    • debian/patches/els/0009-CVE-2026-70461.patch: count a trailing backslash when sizing the appended-wildcard pattern.
    • CVE-2026-70461.
  • SECURITY UPDATE: heap out-of-bounds write in read_args() when the peer's argument count lands exactly on the argv allocation:
    • debian/patches/els/0010-CVE-2026-70456.patch: reserve room for the trailing NULL terminator.
    • CVE-2026-70456.
  • SECURITY UPDATE: out-of-bounds write from a file entry marked FLAG_HLINKED that the receiver accepted with hard-link preservation inactive:
    • debian/patches/els/0011-CVE-2026-70458.patch: gate FLAG_HLINKED on preserve_hard_links and exclude directories.
    • CVE-2026-70458.
  • SECURITY UPDATE: sender-side out-of-bounds read driven by a malicious receiver's checksum header with a non-zero block count and a zero block length:
    • debian/patches/els/0012-CVE-2026-53792.patch: reject a zero block length in read_sum_head().
    • CVE-2026-53792.
  • SECURITY UPDATE: CPU exhaustion in the sending process via quadratic-time behaviour in hash_search(), driven by a malicious receiver's crafted equal-weak-checksum block list. The attacker is the receiver, but the cycles burned are the sender's: hash_search() is reached only through match_sums(), whose sole caller is send_files() in sender.c. NVD's text attributes the CPU to the receiver; the direction stated here is what the code does:
    • debian/patches/els/0013-CVE-2026-70453.patch: bound the per-offset chain walk.
    • CVE-2026-70453.
  • SECURITY UPDATE: daemon "hosts deny" failing open when a configured hostname token cannot be resolved:
    • debian/patches/els/0014-CVE-2026-70452.patch: treat an unresolvable deny-list token as a match.
    • CVE-2026-70452.
  • SECURITY UPDATE: daemon "auth users" ignoring its documented comma-only parsing, silently discarding a deny rule that names a group whose name contains a space:
    • debian/patches/els/0015-CVE-2026-70463.patch: parse the list with conf_strtok().
    • CVE-2026-70463.
  • SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT disabling the client's own I/O timeout through a non-positive or overflowing value:
    • debian/patches/els/0016-CVE-2026-70462.patch: cap the received value and make set_io_timeout() arithmetic overflow-safe.
    • CVE-2026-70462.
  • SECURITY UPDATE: client-supplied --filter merge file bypassing the daemon module filter list:
    • debian/patches/els/0017-CVE-2026-53786.patch: strip the module-dir prefix before the daemon-filter check.
    • CVE-2026-53786.
  • SECURITY UPDATE: per-connection daemon child crash on a crafted first incremental file list whose transfer root is a non-directory dot entry:
    • debian/patches/els/0018-CVE-2026-70459.patch: reject a non-directory transfer-root entry and require a dir_flist entry before trusting parent_ndx 0.
    • CVE-2026-70459.
  • SECURITY UPDATE: malicious sender widening the receiver's --delete scope beyond the destination subtree via implied-parent reclassification:
    • debian/patches/els/0019-CVE-2026-53789.patch: force implied-parent directories non-content on the receiver, including the synthetic transfer root and the pre-protocol-30 encoding.
    • CVE-2026-53789.
  • SECURITY UPDATE: unauthenticated pre-transfer handshake stall holding a per-connection daemon child past the module's max connections limit:
    • debian/patches/els/0020-CVE-2026-70464.patch: bound every peer-controlled handshake read with an absolute deadline and cap the early-protocol argument count.
    • CVE-2026-70464.
  • SECURITY UPDATE: command and argument injection…
Record
CLSA-2026-1788335736
Updated
2026-11-02
OSVCLSA-2026-1789662743 No score

Fix of 6 CVEs

  • SECURITY UPDATE: shell metacharacter injection via daemon config hooks and RSYNC_CONNECT_PROG
    • debian/patches/CVE-2026-53790.patch: backport the upstream fix
    • CVE-2026-53790
  • SECURITY UPDATE: daemon inner-chroot module path escape in the /./ handling
    • debian/patches/CVE-2026-53793.patch: backport the upstream fix
    • CVE-2026-53793
  • SECURITY UPDATE: unbounded hash chain walk in hash_search()
    • debian/patches/CVE-2026-70453.patch: backport the upstream fix
    • CVE-2026-70453
  • SECURITY UPDATE: out-of-bounds F_SUM read in hard_link_check()
    • debian/patches/CVE-2026-70458.patch: backport the upstream fix
    • CVE-2026-70458
  • SECURITY UPDATE: I/O timeout bypass via MSG_IO_TIMEOUT
    • debian/patches/CVE-2026-70462.patch: backport the upstream fix
    • CVE-2026-70462
  • SECURITY UPDATE: unbounded pre-transfer handshake in start_daemon()
    • debian/patches/CVE-2026-70464.patch: backport the upstream fix
    • CVE-2026-70464
Record
CLSA-2026-1789662743
Updated
2026-11-02
OSVCLSA-2026-1789735848 No score

Fix of 6 CVEs

  • SECURITY UPDATE: unbounded hash-chain walk in the delta-transfer matcher
    • debian/patches/CVE-2026-70453.patch: bound the hash_search() chain walk in match.c so a crafted checksum set cannot drive quadratic CPU use
    • CVE-2026-70453
  • SECURITY UPDATE: peer-supplied I/O timeout accepted as non-positive
    • debian/patches/CVE-2026-70462.patch: reject a non-positive MSG_IO_TIMEOUT from the peer in io.c
    • CVE-2026-70462
  • SECURITY UPDATE: unbounded daemon pre-transfer handshake
    • debian/patches/CVE-2026-70464.patch: bound the pre-transfer handshake with a timeout in clientserver.c and io.c
    • CVE-2026-70464
  • SECURITY UPDATE: malicious-peer protocol input and checksum-slot lifetime
    • debian/patches/CVE-2026-70458-1.patch: daemon robustness against malicious-peer protocol input
    • debian/patches/CVE-2026-70458-2.patch: guard the F_SUM checksum-slot lifetime in hlink.c and main.c
    • debian/patches/CVE-2026-70458-3-copy-devices.patch: extend the same guard to the copy-devices path
    • CVE-2026-70458
  • SECURITY UPDATE: daemon authentication, access and argument hardening
    • debian/patches/CVE-2026-53790-1.patch: harden daemon authentication, access, socket and argument handling
    • debian/patches/CVE-2026-53790-2-shell-chars.patch: confine operator- and peer-supplied paths to the served tree and reject shell metacharacters
    • debian/patches/CVE-2026-53790-3-uninit.patch: fix a safe_arg() uninitialized-byte leak in options.c
    • CVE-2026-53790
  • SECURITY UPDATE: inner-module escape for a daemon module using /./
    • debian/patches/CVE-2026-53793-1-basis-paths.patch: stat alternate-basis candidates through the confined resolver in generator.c
    • debian/patches/CVE-2026-53793-2-inner-module.patch: widen the use_secure_symlinks and change_dir() gates from "am_daemon && !am_chrooted" to "am_daemon && (!am_chrooted || module_dirlen)" so an inner module root is the trust boundary, not the kernel chroot
    • CVE-2026-53793
Record
CLSA-2026-1789735848
Updated
2026-11-02
OSVCLSA-2026-1789737518 No score

rsync: Fix of 8 CVEs

  • CVE-2026-70461: count a trailing backslash when sizing the implied-include filter rule, so a --files-from entry ending in a backslash can no longer write one attacker-controlled byte past the rule's heap allocation
  • CVE-2026-70456: reserve the slot read_args() needs for its trailing NULL, so a peer argument count landing exactly on maxargs cannot write one pointer past the argv allocation
  • CVE-2026-70458: refuse FLAG_HLINKED when hard links are not in use and on a directory entry, so a peer cannot displace the checksum slot through hard-link extras that were never reserved; gate the hard-link basis check on S_ISREG(file->mode) so a hard-linked symlink or device cannot read a checksum slot it never had; also set sender_keeps_checksum in the daemon-as-sender path so %C cannot log adjacent heap
  • CVE-2026-70462: reject a non-positive MSG_IO_TIMEOUT from the peer and cap it at 24 hours, and make set_io_timeout()'s arithmetic overflow-safe, so a crafted server can neither disable the client's --timeout nor spin it at 100% CPU on a negative select() timeout
  • CVE-2026-70453: bound the hash_search() chain walk at MAX_CHAIN_LEN, so a basis file whose weak checksums all collide cannot drive an O(file_size * chain_length) scan
  • CVE-2026-53785: create each implied parent directory through do_mkdir_at() against a held O_NOFOLLOW directory fd, so a parent component raced into a symlink can no longer place --relative directories outside the destination
  • CVE-2026-53794: reject --max-alloc=0, which disabled the per-allocation size cap entirely instead of enforcing a zero one
  • CVE-2026-53790: shell-escape %VAR% expansions for their quoting context in the daemon's exec hooks and refuse a peer value holding shell syntax, quote the program names the rsync-ssl helper execs, and widen the remote-shell safe_arg() escape set
Record
CLSA-2026-1789737518
Updated
2026-11-02
OSVCLSA-2026-1789783256 No score

rsync: Fix of 7 CVEs

  • CVE-2026-70456: reserve the slot read_args() needs for its trailing NULL, so a peer argument count landing exactly on maxargs cannot write one pointer past the argv allocation
  • CVE-2026-70458: refuse FLAG_HLINKED when hard links are not in use and on a directory entry, so a peer cannot displace the checksum slot through hard-link extras that were never reserved; also set sender_keeps_checksum in the daemon-as-sender path, and skip the content-based basis match for a hard-linked non-regular file, so %C and --compare-dest cannot read a checksum slot that was never allocated
  • CVE-2026-70462: reject a non-positive MSG_IO_TIMEOUT from the peer and cap it at 24 hours, and make set_io_timeout()'s arithmetic overflow-safe, so a crafted server can neither disable the client's --timeout nor spin it at 100% CPU on a negative select() timeout
  • CVE-2026-70453: bound the hash_search() chain walk at MAX_CHAIN_LEN, so a basis file whose weak checksums all collide cannot drive an O(file_size * chain_length) scan
  • CVE-2026-53785: create each implied parent directory through do_mkdir_at() against a held O_NOFOLLOW directory fd, and widen that wrapper's gate from a non-chrooted daemon to any non-chrooted receiver as upstream does, so a parent component raced into a symlink can no longer place --relative directories outside the destination over ssh either
  • CVE-2026-53794: reject --max-alloc=0, which disabled the per-allocation size cap entirely instead of enforcing a zero one
  • CVE-2026-53790: shell-escape %VAR% expansions for their quoting context in the daemon's exec hooks and refuse a peer value holding shell syntax, quote the program names the rsync-ssl helper execs and restrict the hostname it interpolates into them, refuse a shell-active RSYNC_CONNECT_PROG host, and widen the remote-shell safe_arg() escape set
Record
CLSA-2026-1789783256
Updated
2026-11-02
OSVCLSA-2026-1790173668 No score

rsync: Fix of 6 CVEs

  • CVE-2026-53790: command injection in the daemon pre-/post-xfer exec hooks and RSYNC_CONNECT_PROG
  • CVE-2026-70453: denial of service in hash_search() -- unbounded chain walk
  • CVE-2026-70456: out-of-bounds write in read_args() -- no slot reserved for the trailing NULL
  • CVE-2026-70458: out-of-bounds read of the F_SUM slot in hard_link_check()
  • CVE-2026-70462: denial of service via a peer-supplied MSG_IO_TIMEOUT in set_io_timeout()
  • CVE-2026-70464: denial of service -- unbounded daemon pre-transfer handshake
Record
CLSA-2026-1790173668
Updated
2026-11-02
OSVCLSA-2026-1790267010 No score

rsync: Fix of 7 CVEs

  • CVE-2026-53783: rrsync restricted-directory escape through a symlinked or raced path component, --copy-unsafe-links, -D or a symlinked log file; partial, the dir-merge rule escape needs --confine-root (3.5.0)
  • CVE-2026-53790: the daemon's pre-xfer/post-xfer exec hooks and RSYNC_CONNECT_PROG expanded %RSYNC_*%/%H into a shell command without escaping them
  • CVE-2026-70453: unbounded hash_search() chain walk let a crafted run of equal weak checksums pin the sender at 100% CPU; the per-offset walk is now bounded
  • CVE-2026-70456: heap out-of-bounds write in read_args() when the peer's argument count lands exactly on the argv allocation; room for the trailing NULL is reserved
  • CVE-2026-70458: out-of-bounds write from a file entry marked FLAG_HLINKED accepted while hard-link preservation was inactive; the flag is now gated and excludes dirs
  • CVE-2026-70462: a peer-supplied MSG_IO_TIMEOUT could disable or overflow the client's own I/O timeout; non-positive values are ignored and the value is capped
  • CVE-2026-70464: the pre-transfer daemon handshake ran with no I/O timeout, so an unauthenticated peer could hold every max-connections slot indefinitely
  • safe_arg() left an uninitialized heap byte in remote-shell filename args
Record
CLSA-2026-1790267010
Updated
2026-11-02
OSVMGASA-2026-0487 No score

Updated rsync package fixes security vulnerabilities

Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code.

Record
MGASA-2026-0487
Updated
2026-11-02
OSVopenSUSE-SU-2026:11869-1 No score

rsync-3.5.1-1.1 on GA media

These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11869-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21650-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
openSUSE-SU-2026:21650-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-70462 No score

CVE-2026-70462 in rsync - Patched by Root

Root has patched CVE-2026-70462 in the rsync package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-70462
Updated
2026-11-02
OSVSUSE-SU-2026:23253-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23253-1
Updated
2026-11-02
OSVSUSE-SU-2026:23254-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23254-1
Updated
2026-11-02
OSVSUSE-SU-2026:23289-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23289-1
Updated
2026-11-02
OSVSUSE-SU-2026:23323-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23323-1
Updated
2026-11-02
OSVSUSE-SU-2026:3634-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:3634-1
Updated
2026-11-02
OSVSUSE-SU-2026:3657-1 No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:3657-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rsync
Alpine:v3.21
 3.1.0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.22
 3.1.0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.23
 3.1.0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpine:v3.24
 3.1.0 up to 3.5.0-r0
3.5.0-r0
rsync
Azure Linux:3
 before 3.5.0-1
3.5.0-1
rsync
Alpaquita:23
 3.2.7-r0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpaquita:25
 3.4.1-r0 up to 3.5.0-r0
3.5.0-r0
rsync
Alpaquita:stream
 3.2.5-r0 up to 3.5.0-r0
3.5.0-r0
rsync
TuxCare:Debian:10
From an advisory covering 15 CVEs
 before 3.1.3-6+tuxcare.els5
3.1.3-6+tuxcare.els5
rsync
TuxCare:Ubuntu:16.04
From an advisory covering 6 CVEs
 before 3.1.1-3ubuntu1.3+tuxcare.els17
3.1.1-3ubuntu1.3+tuxcare.els17
Show 48 moreShow less
Affected packages
PackageAffectedFixed
rsync
TuxCare:Ubuntu:20.04
From an advisory covering 6 CVEs
 before 3.1.3-8ubuntu0.9+tuxcare.els11
3.1.3-8ubuntu0.9+tuxcare.els11
rsync
TuxCare:AlmaLinux:9.2
From an advisory covering 8 CVEs
 before 3.2.3-19.el9_2.tuxcare.els16
3.2.3-19.el9_2.tuxcare.els16
rsync-daemon
TuxCare:AlmaLinux:9.2
From an advisory covering 8 CVEs
 before 3.2.3-19.el9_2.tuxcare.els16
3.2.3-19.el9_2.tuxcare.els16
rsync
TuxCare:AlmaLinux:9.6
From an advisory covering 7 CVEs
 before 3.2.5-3.el9_6.tuxcare.els18
3.2.5-3.el9_6.tuxcare.els18
rsync-daemon
TuxCare:AlmaLinux:9.6
From an advisory covering 7 CVEs
 before 3.2.5-3.el9_6.tuxcare.els18
3.2.5-3.el9_6.tuxcare.els18
rsync-rrsync
TuxCare:AlmaLinux:9.6
From an advisory covering 7 CVEs
 before 3.2.5-3.el9_6.tuxcare.els18
3.2.5-3.el9_6.tuxcare.els18
rsync
TuxCare:CentOS:8.5
From an advisory covering 6 CVEs
 before 3.1.3-12.el8.tuxcare.els15
3.1.3-12.el8.tuxcare.els15
rsync-daemon
TuxCare:CentOS:8.5
From an advisory covering 6 CVEs
 before 3.1.3-12.el8.tuxcare.els15
3.1.3-12.el8.tuxcare.els15
rsync
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.1.3-19.el8.1.tuxcare.els11
3.1.3-19.el8.1.tuxcare.els11
rsync-daemon
TuxCare:CentOS-Stream:8
From an advisory covering 7 CVEs
 before 3.1.3-19.el8.1.tuxcare.els11
3.1.3-19.el8.1.tuxcare.els11
rsync
Debian:12
 All versions, plus listed versions
3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u33.2.7-1+deb12u4
Show 29 moreShow less
3.2.7-1+deb12u53.2.7-1+deb12u63.3.0+ds1-13.3.0+ds1-23.3.0+ds1-33.3.0+ds1-43.3.0-13.4.1+ds1-13.4.1+ds1-23.4.1+ds1-33.4.1+ds1-43.4.1+ds1-4~exp13.4.1+ds1-4~exp23.4.1+ds1-53.4.1+ds1-5~exp13.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-13.5.0+ds1-13.5.0+ds1-23.5.0+ds1-33.5.1+ds1-13.5.1+ds1-23.5.2+ds1-1
 None known
rsync
Debian:13
 before 3.5.0+ds1-0+deb13u1, plus listed versions
3.4.1+ds1-53.4.1+ds1-5+deb13u13.4.1+ds1-5+deb13u23.4.1+ds1-5+deb13u33.4.1+ds1-5+deb13u4
Show 8 moreShow less
3.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-1
3.5.0+ds1-0+deb13u1
rsync
Debian:14
 before 3.5.0+ds1-1, plus listed versions
3.4.1+ds1-53.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-1
Show 4 moreShow less
3.4.2+ds1-23.4.3+ds1-13.4.3+ds1-23.4.4+ds1-1
3.5.0+ds1-1
rsync
Mageia:10
From an advisory covering 33 CVEs
 before 3.5.1-1.mga10
3.5.1-1.mga10
rsync
openEuler:24.03-LTS-SP1
From an advisory covering 33 CVEs
 before 3.2.7-12.oe2403sp1
3.2.7-12.oe2403sp1
rsync
openEuler:24.03-LTS-SP3
From an advisory covering 33 CVEs
 before 3.2.7-12.oe2403sp3
3.2.7-12.oe2403sp3
rsync
openEuler:24.03-LTS-SP4
From an advisory covering 33 CVEs
 before 3.2.7-12.oe2403sp4
3.2.7-12.oe2403sp4
rsync
Root:Debian:11
 before 3.2.3-4+deb11u4.aikido.2
3.2.3-4+deb11u4.aikido.23.2.3-4+deb11u4.aikido.3
rootio-rsync
Root:Debian:11
 before 3.2.3-4+deb11u4.aikido.2
3.2.3-4+deb11u4.aikido.23.2.3-4+deb11u4.aikido.3
rsync
SUSE:Linux Micro 6.0
From an advisory covering 37 CVEs
 before 3.2.7-8.1
3.2.7-8.1
rsync
SUSE:Linux Micro 6.1
From an advisory covering 33 CVEs
 before 3.3.0-slfo.1.1_7.1
3.3.0-slfo.1.1_7.1
rsync
SUSE:Linux Micro 6.2
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 33 CVEs
 before 3.2.7-150600.3.24.1
3.2.7-150600.3.24.1
rsync
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.3
Show 5 moreShow less
3.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm23.1.0-2ubuntu0.4+esm33.1.0-2ubuntu0.4+esm4
 None known
rsync
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3
Show 6 moreShow less
3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm43.1.1-3ubuntu1.3+esm53.1.1-3ubuntu1.3+esm6
 None known
rsync
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2
Show 8 moreShow less
3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm23.1.2-2.1ubuntu1.6+esm33.1.2-2.1ubuntu1.6+esm4
 None known
rsync
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
Show 7 moreShow less
3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.93.1.3-8ubuntu0.9+esm13.1.3-8ubuntu0.9+esm2
 None known
rsync
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3
Show 6 moreShow less
3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.43.2.7-0ubuntu0.22.04.63.2.7-0ubuntu0.22.04.7
 None known
rsync
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.23.2.7-1ubuntu1.43.2.7-1ubuntu1.5
 None known
rsync
Ubuntu:26.10
 All versions, plus listed versions
3.4.1+ds1-73.4.4+ds1-13.4.4+ds1-1build13.5.0+ds1-2
 None known
rsync
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-73.4.1+ds1-7ubuntu0.23.4.1+ds1-7ubuntu0.3
 None known
rsync
openSUSE:Tumbleweed
From an advisory covering 37 CVEs
 before 3.5.1-1.1
3.5.1-1.1
rsync
openSUSE:Leap 16.0
From an advisory covering 41 CVEs
 before 3.4.1-160000.6.1
3.4.1-160000.6.1

History

History
RecordedChangedSources
affectedOSV
affectedOSV
affectedOSV
facts, referencesNVD
affected, aliases, products, published, referencesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-70462 is a high vulnerability (CVSS 7.1) in Rsyncproject Rsync, published August 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in rsync 3.5.0-r0.

References

Show 140 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open