{"id":"CVE-2026-44510","aliases":["DEBIAN-CVE-2026-44510","EUVD-2026-46111","SUSE-SU-2026:23289-1","SUSE-SU-2026:23323-1","openSUSE-SU-2026:11869-1","openSUSE-SU-2026:21650-1"],"status":"rejected","title":"Security update for rsync","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should reference CVE-2026-43620 instead of this candidate.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"euvd"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-20T21:03:17Z","modified":"2026-09-24T18:23:15Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.1"}]}],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44510","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269039","tags":["report"]},{"url":"https://bugzilla.suse.com/1269040","tags":["report"]},{"url":"https://bugzilla.suse.com/1269041","tags":["report"]},{"url":"https://bugzilla.suse.com/1269042","tags":["report"]},{"url":"https://bugzilla.suse.com/1269043","tags":["report"]},{"url":"https://bugzilla.suse.com/1269044","tags":["report"]},{"url":"https://bugzilla.suse.com/1269045","tags":["report"]},{"url":"https://bugzilla.suse.com/1269046","tags":["report"]},{"url":"https://bugzilla.suse.com/1269047","tags":["report"]},{"url":"https://bugzilla.suse.com/1269048","tags":["report"]},{"url":"https://bugzilla.suse.com/1269049","tags":["report"]},{"url":"https://bugzilla.suse.com/1269050","tags":["report"]},{"url":"https://bugzilla.suse.com/1269051","tags":["report"]},{"url":"https://bugzilla.suse.com/1269052","tags":["report"]},{"url":"https://bugzilla.suse.com/1269053","tags":["report"]},{"url":"https://bugzilla.suse.com/1269054","tags":["report"]},{"url":"https://bugzilla.suse.com/1269055","tags":["report"]},{"url":"https://bugzilla.suse.com/1269056","tags":["report"]},{"url":"https://bugzilla.suse.com/1269057","tags":["report"]},{"url":"https://bugzilla.suse.com/1269058","tags":["report"]},{"url":"https://bugzilla.suse.com/1269060","tags":["report"]},{"url":"https://bugzilla.suse.com/1271931","tags":["report"]},{"url":"https://bugzilla.suse.com/1271932","tags":["report"]},{"url":"https://bugzilla.suse.com/1271933","tags":["report"]},{"url":"https://bugzilla.suse.com/1271934","tags":["report"]},{"url":"https://bugzilla.suse.com/1273429","tags":["report"]},{"url":"https://bugzilla.suse.com/1273430","tags":["report"]},{"url":"https://bugzilla.suse.com/1273431","tags":["report"]},{"url":"https://bugzilla.suse.com/1273432","tags":["report"]},{"url":"https://bugzilla.suse.com/1273433","tags":["report"]},{"url":"https://bugzilla.suse.com/1273434","tags":["report"]},{"url":"https://bugzilla.suse.com/1273435","tags":["report"]},{"url":"https://bugzilla.suse.com/1273436","tags":["report"]},{"url":"https://bugzilla.suse.com/1273437","tags":["report"]},{"url":"https://bugzilla.suse.com/1273438","tags":["report"]},{"url":"https://bugzilla.suse.com/1273439","tags":["report"]},{"url":"https://bugzilla.suse.com/1273440","tags":["report"]},{"url":"https://bugzilla.suse.com/1273441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623323-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44510","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should reference CVE-2026-43620 instead of this candidate.","status":"rejected","published":"2026-07-20T21:03:17.056Z","modified":"2026-07-21T15:11:32.982Z","updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-46111","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should reference CVE-2026-43620 instead of this candidate.","status":"published","published":"2026-07-20T21:03:17Z","modified":"2026-07-21T15:11:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:19:47.436242Z"}],"nvd":[{"id":"CVE-2026-44510","description":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason: This candidate is a duplicate of CVE-2026-43620. Notes: All CVE users should reference CVE-2026-43620 instead of this candidate.","status":"rejected","published":"2026-07-20T22:17:13.957Z","modified":"2026-07-21T16:17:10.963Z","updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-44510","description":"Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv_files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully wire-protocol-level, requires no special options on the victim, and works for both rsync:// URLs and remote-shell pulls; since inc_recurse is the protocol-30+ default, any client doing a normal recursive pull against an attacker-controlled URL is exposed. A malicious server sets CF_INC_RECURSE, sends a flist whose first sorted entry is not the leading \".\" directory (causing parent_ndx to be set to -1), then sends a transfer record with ndx = 0 and an iflag omitting ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference the result in f_name(). The impact is crash-only: the out-of-bounds read lands in glibc mmap chunk metadata and dereferences to an unmapped low address, producing a SEGV that cannot be leveraged into an exploit (confirmed on glibc x86-64 Linux; non-glibc allocators not audited). This issue is fixed in version 3.4.3.","status":"withdrawn","published":"2026-07-20T22:17:13.957Z","modified":"2026-07-22T02:00:46.29637278Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"openSUSE-SU-2026:11869-1","title":"rsync-3.5.1-1.1 on GA media","description":"These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:15.541661994Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21650-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:55Z","modified":"2026-08-27T17:30:03.680559724Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23289-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:35Z","modified":"2026-09-04T18:23:13.554181498Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23323-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:35Z","modified":"2026-09-10T18:23:10.543995859Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}