CentOS Linux 7 [TuxCare] Security Update: rsync (CENTOS7:CLSA-2026:1792582985)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792582985 advisory. - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS-STREAM8:CLSA-2026:1792425300)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1792425300 advisory. - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one...

CentOS Linux 8.5 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.5:CLSA-2026:1792425174)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1792425174 advisory. - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one...

CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.4:CLSA-2026:1792411866)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792411866 advisory. - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130076 advisory. rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink...

WS-2026-0156

n8n-nodes-base before 1.121.55, 2.x before 2.43.3 and 2.44.0: the Read/Write Files from Disk and Read Binary Files node evaluates the Files Selector glob on the main event loop with no time limit, so a crafted wildcard pattern blocks the n8n process GHSA-m7gv-mpg5-7c9v...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130119 advisory. rsync 3.2.5 before 3.5.0contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the...

PT-2026-116244

Уязвимость функции MasterHandler.process files from worker платформы для мониторинга безопасности и обнаружения угроз Wazuh связана с недостатками процедуры авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с правами root...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788520884)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788520884 advisory. - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete...

rsync: rsync: Information disclosure and denial of service via crafted files-from entry

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

rsync: rsync: Information disclosure and denial of service via crafted files-from entry

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

rsync: rsync: Information disclosure and denial of service via crafted files-from entry

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

CVE-2026-53802

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

...

CVE-2026-70461

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

SUSE CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the addimpliedinclude function when processing a crafted files-from entry containing both an interior and trailing backslash. An attacker can cause a write of one attacker-controlled byte past the end of a heap...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via improper handling of symlinks in input configuration file processing, including --files-from, --password-file, and filter merge files. An attacker can access files outside the intended directory ...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

AZL-95765 CVE-2026-70461 affecting package rsync for versions less than 3.5.0-1

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...