CVE-2026-53788

A newline injection vulnerability exists in rsync's uid/gid mapping process. An attacker can inject newline characters into user or group names, causing the rsync daemon to process attacker-controlled data as legitimate protocol input. This results in data corruption within the uid/gid mapping...

CVE-2026-70459

A flaw was found in rsync. A remote attacker could send a specially crafted file list to the rsync daemon. This could lead to a null pointer dereference, causing the daemon to crash and resulting in a Denial of Service DoS. Mitigation To mitigate this issue, restrict network access to the rsync...

CVE-2024-12084

CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths s2length in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH 16 bytes, an attacker can write out of bounds in the sum2 buffer. How...

CVE-2026-70464

A denial of service flaw was found in the rsync daemon. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection...

SUSE CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

SUSE CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

ALPINE-CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

AZL-95792 CVE-2026-70464 affecting package rsync 3.4.3-1

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

AZL-95783 CVE-2026-53791 affecting package rsync for versions less than 3.5.0-1

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

ALPINE-CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

EUVD-2026-58040

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

EUVD-2026-58099

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a...

PT-2026-71664

Name of the Vulnerable Software and Affected Versions rsync daemon versions 2.0.0 through 3.4.9 Description A denial of service issue exists that allows unauthenticated remote attackers to exhaust daemon connection slots. This is achieved by stalling the handshake process either before or after...

PT-2026-71629

Name of the Vulnerable Software and Affected Versions rsync daemon versions prior to 3.5.0 Description An IP address spoofing issue exists that allows unauthenticated remote attackers to bypass IP-based access controls. By sending a crafted PROXY protocol header containing a forged source address...

Oracle Linux 8 : rsync (ELSA-2026-26408)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26408 advisory. - Integer overflow in compressed-token decoding CVE-2026-43618 Tenable has extracted the preceding description block directly from the Oracle Linux...