net/rsync -- multiple vulnerabilities

rsync project reports: This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck CNA; th...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

PT-2026-71640

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a...

CVE-2026-53801: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

CVE-2026-53803: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...

CVE-2026-70464: Allocation of Resources Without Limits or Throttling

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

PT-2026-71629

Name of the Vulnerable Software and Affected Versions rsync daemon versions prior to 3.5.0 Description An IP address spoofing issue exists that allows unauthenticated remote attackers to bypass IP-based access controls. By sending a crafted PROXY protocol header containing a forged source address...

CVE-2026-53790: Improper Neutralization of Special Elements used in an OS Command

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

CVE-2026-70459

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a director...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

PT-2026-71659

Name of the Vulnerable Software and Affected Versions rsync versions 3.0.0 through 3.4.x Description A null pointer dereference occurs in the daemon child process. A remote attacker can cause the daemon to crash by sending a file list where the first entry is a dot entry not typed as a directory...

DEBIAN-CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

UBUNTU-CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service DoS in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 ICMPv6 Router Advertisement with a zero-length option,...

CVE-2026-17445

IBM i (versions 7.3–7.6, 5770-SS1) is vulnerable to CVE-2026-17445 via Line Printer Daemon (LPD). An remote authenticated attacker could bypass security restrictions due to improper validation of an attacker-supplied user profile name. CVSS v3.1 base score 8.2 (HIGH) with network attack vector, n...

CVE-2026-17218 IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-17218 IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write...

CVE-2026-17218

CVE-2026-17218 affects IBM i (Line Printer Daemon, LPD) across releases 7.3–7.6. An out-of-bounds write could allow a remote attacker to execute arbitrary code. The IBM bulletin confirms a CVSS v3.1 base score of 9.8 (Network, high impact) and lists affected products/versions along with fixed pat...

CVE-2026-71407

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit...

EUVD-2026-57191

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit...