3231 matches found
CVE-2026-53788
A newline injection vulnerability exists in rsync's uid/gid mapping process. An attacker can inject newline characters into user or group names, causing the rsync daemon to process attacker-controlled data as legitimate protocol input. This results in data corruption within the uid/gid mapping...
EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-3383)
According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...
EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-3308)
According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...
NewStart CGSL MAIN 7.02 : rsync Vulnerability (NS-SA-2026-0113)
The remote NewStart CGSL host, running version MAIN 7.02, has rsync packages installed that are affected by a vulnerability: - A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious...
CVE-2026-53801
A symlink race condition in rsync's sender directory scanning logic allows a local attacker to bypass intended access restrictions. By replacing a symlink with a directory entry pointing outside the module root during an active scan, the attacker can force rsync to enumerate and transfer...
CVE-2026-53798
A privilege confusion vulnerability in rsync's name-converter subprocess allows a local attacker to achieve privilege escalation. By manipulating the subprocess to return empty values for uid or gid lookups, the attacker forces rsync to incorrectly interpret these as root uid/gid 0. Consequently,...
CVE-2026-53797
A symlink race condition in rsync's source tree traversal allows a low-privileged local attacker to access unauthorized files. By atomically replacing a parent directory component with a symlink during an active transfer, the attacker can redirect file reads outside the intended transfer root,...
CVE-2026-53796
A time-of-check to time-of-use TOCTOU race condition in rsync's non-daemon receiver allows a local attacker to compromise data integrity. By substituting a symbolic link for a destination path component during directory processing, an attacker can redirect file writes to unintended locations...
CVE-2026-53786
A flaw was found in rsync. This vulnerability allows authenticated clients to bypass module-level filter restrictions. By supplying malicious merge file directives, an attacker can inject rules that override the daemon's intended file exclusion policies. This leads to information disclosure, as...
CVE-2026-53799
A symlink race condition in rsync allows a local attacker to achieve privilege escalation. By substituting a symlink at a predictable destination path between a file write and the application of access control lists ACLs or extended attributes xattrs, an attacker can redirect these permissions to...
CVE-2026-70459
A flaw was found in rsync. A remote attacker could send a specially crafted file list to the rsync daemon. This could lead to a null pointer dereference, causing the daemon to crash and resulting in a Denial of Service DoS. Mitigation To mitigate this issue, restrict network access to the rsync...
CVE-2026-53800
A Time-of-Check Time-of-Use TOCTOU race condition in rsync's --remove-source-files option allows a local attacker to delete arbitrary files. By replacing a source file with a symlink immediately after transfer but before deletion, the attacker can force rsync to delete the symlink target, resulti...
CVE-2026-70457
An out-of-bounds write vulnerability in rsync's parsesizearg function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and...
CVE-2026-53802
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...
CVE-2026-53789
An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a...
ROOT-OS-DEBIAN-11-CVE-2026-53803 CVE-2026-53803 in rsync - Patched by Root
Root has patched CVE-2026-53803 in the rsync package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-70455 CVE-2026-70455 in rsync - Patched by Root
Root has patched CVE-2026-70455 in the rsync package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-53783 CVE-2026-53783 in rsync - Patched by Root
Root has patched CVE-2026-53783 in the rsync package for Root:Debian:11. Multiple fixed versions available...