Linux Distros Unpatched Vulnerability : CVE-2026-53784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabl...

net/rsync -- multiple vulnerabilities

rsync project reports: This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck CNA; th...

PT-2026-71630

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An out-of-bounds read exists in the sender-side block matching logic. A malicious receiver can trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a...

PT-2026-71622

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description The rrsync restricted shell wrapper contains a time-of-check to time-of-use TOCTOU race condition. This occurs when a system checks a condition such as a file path validation and then uses the result o...

PT-2026-71638

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the --remove-source-files feature. This occurs when an attacker with symlink creation access atomically substitutes a symlink for a source file between the completion...

PT-2026-71639

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's directory scanning logic. This occurs when an attacker manipulates symlinks in a path component of the scanned tree, replacing a symlink with a directory...

PT-2026-71633

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the --temp-dir or --link-dest options, whi...

PT-2026-71662

Name of the Vulnerable Software and Affected Versions rsync versions 3.1.0 through 3.4.x Description A signed integer overflow exists in the I/O timeout implementation. An attacker can inject MSG IO TIMEOUT messages containing non-positive values zero or negative, causing the timeout variable to...

PT-2026-71628

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Multiple command and argument injection issues allow attackers to execute arbitrary commands by providing malicious input through various code paths. These paths include the RSYNC CONNECT PROG...

PT-2026-71624

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path traversal issue exists when using --relative mode. A malicious sender can write files outside the intended destination directory tree by crafting relative paths containing symlink components. Th...

PT-2026-71625

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Authenticated clients can bypass module-level filter restrictions by providing malicious --filter merge file directives. During filter evaluation, attackers can inject client-side merge file directives...

PT-2026-71631

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths...

CVE-2026-70461

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

PT-2026-71653

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An algorithmic complexity issue exists in the hash search function. A remote attacker can trigger a denial of service by sending a carefully constructed file list. This exploit leverages quadratic-time...

PT-2026-71664

Name of the Vulnerable Software and Affected Versions rsync daemon versions 2.0.0 through 3.4.9 Description A denial of service issue exists that allows unauthenticated remote attackers to exhaust daemon connection slots. This is achieved by stalling the handshake process either before or after...

Linux Distros Unpatched Vulnerability : CVE-2026-53799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to...

Linux Distros Unpatched Vulnerability : CVE-2026-70456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs function that allows a malicious sender to corrupt adjacent heap memory b...

Linux Distros Unpatched Vulnerability : CVE-2026-53795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an...

Linux Distros Unpatched Vulnerability : CVE-2026-53801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumera...

Linux Distros Unpatched Vulnerability : CVE-2026-53792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory acces...