{"id":"CVE-2026-70455","aliases":["ALPINE-CVE-2026-70455","ALSA-2026:67463","AZL-95807","BELL-CVE-2026-70455","DEBIAN-CVE-2026-70455","EUVD-2026-58049","GHSA-rjvj-qgqg-cvx9","MGASA-2026-0487","RHSA-2026:67463","RLSA-2026:67463","ROOT-OS-DEBIAN-11-CVE-2026-70455","SUSE-SU-2026:23253-1","SUSE-SU-2026:23254-1","SUSE-SU-2026:23289-1","SUSE-SU-2026:23323-1","SUSE-SU-2026:3634-1","SUSE-SU-2026:3657-1","UBUNTU-CVE-2026-70455","openSUSE-SU-2026:11869-1","openSUSE-SU-2026:21650-1"],"status":"published","title":"rsync 3.4.2 \u003c 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00566,"percentile":0.47308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-08-13T14:45:11Z","modified":"2026-11-09T05:00:09Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.5.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.5.0+ds1-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.5.0+ds1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.5.0+ds1-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rsync","fixed_in":["3.2.3-4+deb11u4.aikido.2","3.2.3-4+deb11u4.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-rsync","fixed_in":["3.2.3-4+deb11u4.aikido.2","3.2.3-4+deb11u4.aikido.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.2"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.2"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.2"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.2"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-r0"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+ds1-0+deb12u1"}]}],"versions":["3.2.7-1","3.2.7-1+deb12u1","3.2.7-1+deb12u2","3.2.7-1+deb12u3","3.2.7-1+deb12u4","3.2.7-1+deb12u5","3.2.7-1+deb12u6","3.3.0+ds1-1","3.3.0+ds1-2","3.3.0+ds1-3","3.3.0+ds1-4","3.3.0-1","3.4.1+ds1-1","3.4.1+ds1-2","3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-4~exp1","3.4.1+ds1-4~exp2","3.4.1+ds1-5","3.4.1+ds1-5~exp1","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1","3.4.2+ds1-1","3.4.2+ds1-2","3.4.3+ds1-1","3.4.3+ds1-2","3.4.4+ds1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+ds1-0+deb13u1"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-5+deb13u1","3.4.1+ds1-5+deb13u2","3.4.1+ds1-5+deb13u3","3.4.1+ds1-5+deb13u4","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1","3.4.2+ds1-1","3.4.2+ds1-2","3.4.3+ds1-1","3.4.3+ds1-2","3.4.4+ds1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+ds1-1"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1","3.4.2+ds1-1","3.4.2+ds1-2","3.4.3+ds1-1","3.4.3+ds1-2","3.4.4+ds1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.mga10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.0-3.el10_2"}]}],"bundled":21},{"source":"osv","ecosystem":"Root:Debian:11","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-4+deb11u4.aikido.2"},{"fixed":"3.2.3-4+deb11u4.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-4+deb11u4.aikido.2"},{"fixed":"3.2.3-4+deb11u4.aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-8.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-slfo.1.1_7.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.24.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.24.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.24.1"}]}],"bundled":33},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2","3.1.0-2ubuntu0.4+esm3","3.1.0-2ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4","3.1.1-3ubuntu1.3+esm5","3.1.1-3ubuntu1.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2","3.1.2-2.1ubuntu1.6+esm3","3.1.2-2.1ubuntu1.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9","3.1.3-8ubuntu0.9+esm1","3.1.3-8ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4","3.2.7-0ubuntu0.22.04.6","3.2.7-0ubuntu0.22.04.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2","3.2.7-1ubuntu1.4","3.2.7-1ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+ds1-7","3.4.4+ds1-1","3.4.4+ds1-1build1","3.5.0+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-7ubuntu0.2","3.4.1+ds1-7ubuntu0.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.1"}]}],"bundled":37},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41}],"products":[{"vendor":"rsyncproject","product":"rsync"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9","tags":["vendor-advisory","Vendor Advisory","advisory","article"]},{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","tags":["release-notes","Product","Release Notes","advisory","article"]},{"url":"https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion","tags":["third-party-advisory","Release Notes","Third Party Advisory","advisory","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-70455","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67463","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53783","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53785","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53790","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53791","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53793","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53802","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53803","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70452","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70453","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70454","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70455","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70456","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70457","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70458","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70460","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70461","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70463","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70464","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515368","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515373","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515378","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515379","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515380","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515381","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515384","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515385","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515386","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515387","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515389","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515395","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515396","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515403","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515406","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515409","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515417","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515419","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-67463.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70455","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-70455","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70455.json","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-70455","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0487.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36138","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/13/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AHYZL7IBFVF463AGDTJUQBYUJUW7JUAB/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00440.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515419","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67463.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53783","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53785","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53791","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53793","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53802","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70452","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70453","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70454","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70454","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70455","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70456","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70457","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70457","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70460","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70463","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67463","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623253-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269039","tags":["report"]},{"url":"https://bugzilla.suse.com/1269040","tags":["report"]},{"url":"https://bugzilla.suse.com/1269041","tags":["report"]},{"url":"https://bugzilla.suse.com/1269042","tags":["report"]},{"url":"https://bugzilla.suse.com/1269043","tags":["report"]},{"url":"https://bugzilla.suse.com/1269044","tags":["report"]},{"url":"https://bugzilla.suse.com/1269045","tags":["report"]},{"url":"https://bugzilla.suse.com/1269046","tags":["report"]},{"url":"https://bugzilla.suse.com/1269047","tags":["report"]},{"url":"https://bugzilla.suse.com/1269048","tags":["report"]},{"url":"https://bugzilla.suse.com/1269049","tags":["report"]},{"url":"https://bugzilla.suse.com/1269050","tags":["report"]},{"url":"https://bugzilla.suse.com/1269051","tags":["report"]},{"url":"https://bugzilla.suse.com/1269052","tags":["report"]},{"url":"https://bugzilla.suse.com/1269053","tags":["report"]},{"url":"https://bugzilla.suse.com/1269054","tags":["report"]},{"url":"https://bugzilla.suse.com/1269055","tags":["report"]},{"url":"https://bugzilla.suse.com/1269056","tags":["report"]},{"url":"https://bugzilla.suse.com/1269057","tags":["report"]},{"url":"https://bugzilla.suse.com/1269058","tags":["report"]},{"url":"https://bugzilla.suse.com/1269060","tags":["report"]},{"url":"https://bugzilla.suse.com/1273429","tags":["report"]},{"url":"https://bugzilla.suse.com/1273430","tags":["report"]},{"url":"https://bugzilla.suse.com/1273431","tags":["report"]},{"url":"https://bugzilla.suse.com/1273432","tags":["report"]},{"url":"https://bugzilla.suse.com/1273433","tags":["report"]},{"url":"https://bugzilla.suse.com/1273434","tags":["report"]},{"url":"https://bugzilla.suse.com/1273435","tags":["report"]},{"url":"https://bugzilla.suse.com/1273436","tags":["report"]},{"url":"https://bugzilla.suse.com/1273437","tags":["report"]},{"url":"https://bugzilla.suse.com/1273438","tags":["report"]},{"url":"https://bugzilla.suse.com/1273439","tags":["report"]},{"url":"https://bugzilla.suse.com/1273440","tags":["report"]},{"url":"https://bugzilla.suse.com/1273441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623254-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271931","tags":["report"]},{"url":"https://bugzilla.suse.com/1271932","tags":["report"]},{"url":"https://bugzilla.suse.com/1271933","tags":["report"]},{"url":"https://bugzilla.suse.com/1271934","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44510","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623323-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263634-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263657-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-70455","tags":["report"]},{"url":"https://download.samba.org/pub/rsync/NEWS#3.5.0","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-70455","title":"rsync 3.4.2 \u003c 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T14:45:11.164Z","modified":"2026-08-14T19:45:47.934Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:35:33.380441Z"}],"euvd":[{"id":"EUVD-2026-58049","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T14:45:11Z","modified":"2026-08-14T19:45:47Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:53.534541Z"}],"nvd":[{"id":"CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T15:19:59.197Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"ALPINE-CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T15:19:59.197Z","modified":"2026-10-01T02:17:49.39408671Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-70455","status":"published","published":"2026-08-15T06:06:33.40287Z","modified":"2026-09-25T07:15:04.177820031Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-70455","title":"rsync 3.4.2 \u003c 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T14:45:11.164Z","modified":"2026-10-28T02:30:25.318399642Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T15:19:59.197Z","modified":"2026-11-09T05:00:09.414641167Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-09T05:19:10.514151Z"},{"id":"RHSA-2026:67463","title":"Red Hat Security Advisory: rsync security, bug fix, and enhancement update","status":"published","published":"2026-09-15T10:17:15Z","modified":"2026-10-10T10:18:14Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:67463","title":"Important: rsync security, bug fix, and enhancement update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)\n\n* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)\n\n* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)\n\n* rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)\n\n* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)\n\n* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)\n\n* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)\n\n* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)\n\n* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)\n\n* rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)\n\n* rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)\n\n* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)\n\n* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)\n\n* rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)\n\n* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)\n\n* rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)\n\n* rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)\n\n* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)\n\n* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)\n\n* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)\n\n* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T12:08:56.876794Z","modified":"2026-09-15T12:30:03.321710965Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T15:19:00Z","modified":"2026-10-17T12:59:27.386979617Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"ALSA-2026:67463","title":"Important: rsync security, bug fix, and enhancement update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)\n  * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)\n  * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)\n  * rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)\n  * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)\n  * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)\n  * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)\n  * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)\n  * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)\n  * rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)\n  * rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)\n  * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)\n  * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)\n  * rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)\n  * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)\n  * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)\n  * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)\n  * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)\n  * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)\n  * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)\n  * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-29T11:30:43.480628079Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-95807","title":"CVE-2026-70455 affecting package rsync for versions less than 3.5.0-1","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.","status":"published","published":"2026-08-13T15:19:59Z","modified":"2026-09-10T14:17:03.968972742Z","updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"MGASA-2026-0487","title":"Updated rsync package fixes security vulnerabilities","description":"Several vulnerabilities were discovered in rsync, a fast, versatile,\nremote (and local) file-copying tool, which could result in local\nprivilege escalation, bypass of intended access restrictions,\ninformation disclosure, denial of service or the execution of arbitrary\ncode.\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:00:44.437948684Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11869-1","title":"rsync-3.5.1-1.1 on GA media","description":"These are all security issues fixed in the rsync-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:15.541661994Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21650-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:55Z","modified":"2026-08-27T17:30:03.680559724Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-70455","title":"CVE-2026-70455 in rsync - Patched by Root","description":"Root has patched CVE-2026-70455 in the rsync package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-02T12:05:14Z","modified":"2026-09-02T14:00:12.30454899Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"SUSE-SU-2026:23253-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-24T14:42:20Z","modified":"2026-08-27T18:23:12.181176422Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23254-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (local privilege\n  escalation) (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-24T14:41:03Z","modified":"2026-08-31T18:23:08.005451973Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23289-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:35Z","modified":"2026-09-04T18:23:13.554181498Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23323-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:35Z","modified":"2026-09-10T18:23:10.543995859Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3634-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (local privilege\n  escalation) (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-17T19:03:56Z","modified":"2026-08-18T09:30:04.645936343Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3657-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (local privilege\n  escalation) (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-20T17:06:16Z","modified":"2026-08-21T09:15:06.399709911Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}