Rsyncproject Rsync vulnerabilities

CVE-2026-53791 [CRITICAL] CWE-290 CVE-2026-53791: rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumv

CVE-2026-53790 [HIGH] CWE-78 CVE-2026-53790: rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attac rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell

CVE-2026-70460 [HIGH] CWE-22 CVE-2026-70460: rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to e rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct

CVE-2026-70461 [HIGH] CWE-787 CVE-2026-70461: rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauth rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containi

CVE-2026-53793 [HIGH] CWE-59 CVE-2026-53793: rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to es rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers

CVE-2026-70452 [HIGH] CWE-636 CVE-2026-70452: rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attacker rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling a

CVE-2026-43618 [HIGH] CWE-125 CVE-2026-43618: Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token deco Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability

CVE-2026-53783 [HIGH] CWE-59 CVE-2026-53783: rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricte

CVE-2026-70463 [HIGH] CWE-863 CVE-2026-70463: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the spa

CVE-2026-53789 [HIGH] CWE-807 CVE-2026-53789: rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender t rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multip

CVE-2026-70458 [HIGH] CWE-787 CVE-2026-70458: rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corr rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of t

CVE-2026-44508 [HIGH] CWE-190 CVE-2026-44508: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver's compressed-token decoder accumulated a 32-bit signed counter without checking for overflow. A malicious sender can trigger an overflow that with careful manipulation can lead to the extraction of data stor

CVE-2026-70456 [HIGH] CWE-787 CVE-2026-70456: rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function t rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, cor

CVE-2026-53795 [HIGH] CWE-59 CVE-2026-53795: rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write fil rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values

CVE-2026-70464 [HIGH] CWE-770 CVE-2026-70464: rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticat rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid

CVE-2026-70457 [HIGH] CWE-131 CVE-2026-70457: rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion

CVE-2026-53803 [HIGH] CWE-59 CVE-2026-53803: rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwri rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to a

CVE-2026-70453 [HIGH] CWE-407 CVE-2026-70453: rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function th rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entri

CVE-2026-70454 [HIGH] CWE-295 CVE-2026-70454: rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS ce rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or v

CVE-2026-70455 [HIGH] CWE-770 CVE-2026-70455: rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to e rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstand