3775 matches found
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
...
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
...
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
...
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
...
rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT
...
rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
...
rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
...
rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
...
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
...
rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall
...
[SECURITY] Fedora 44 Update: rsync-3.5.0-1.fc44
Rsync uses a reliable algorithm to bring remote and host files into sync very quickly. Rsync is fast because it just sends the differences in the files over the network instead of sending the complete files. Rsync is often used as a very powerful mirroring process or just as a more capable...
SUSE SLED15 / SLES15 Security Update : rsync (SUSE-SU-2026:3657-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3657-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist...
Fedora 44 : rsync (2026-bfae8723e2)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bfae8723e2 advisory. New version 3.5.0. Includes fixes for following CVEs: CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789...
CVE-2026-53793
A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access ...
CVE-2026-70462
A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to...
CVE-2026-53795
A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...
CVE-2026-53794
A flaw was found in rsync. A logic error in the --max-alloc handling allows a remote attacker to disable memory allocation sanity checks by setting --max-alloc=0. This can lead to the receiver attempting unbounded memory allocations, potentially exhausting available memory and causing a denial of...
CVE-2026-70452
A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees. Mitigation To mitigate this issue...
CVE-2026-53790
A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...
CVE-2026-53791
A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources. Mitigation Restrict rsync daemon TCP/873 to the trusted proxy only CME-202...