Rsyncproject Rsync vulnerabilities

CVE-2026-53802 [HIGH] CWE-61 CVE-2026-53802: rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file p

CVE-2026-53784 [HIGH] CWE-59 CVE-2026-53784: rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access file rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, caus

CVE-2026-53785 [HIGH] CWE-59 CVE-2026-53785: rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write f rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without ve

CVE-2026-29518 [HIGH] CWE-367 CVE-2026-29518: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite a

CVE-2026-53786 [MEDIUM] CWE-863 CVE-2026-53786: rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining

CVE-2026-53788 [MEDIUM] CWE-93 CVE-2026-53788: rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause

CVE-2026-43619 [MEDIUM] CWE-59 CVE-2026-43619: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system ca Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timi

CVE-2026-53799 [MEDIUM] CWE-59 CVE-2026-53799: rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to ca rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing win

CVE-2026-53801 [MEDIUM] CWE-59 CVE-2026-53801: rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scannin rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory

CVE-2026-53792 [MEDIUM] CWE-129 CVE-2026-53792: rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching lo rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to caus

CVE-2026-44509 [MEDIUM] CWE-59 CVE-2026-44509: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open() calls missed races in other path based system calls like chmod() and chown(). For rsync daemons with "use chroot = no" this allows an attacker with local filesystem access

CVE-2026-70462 [MEDIUM] CWE-190 CVE-2026-70462: rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout impleme rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wra

CVE-2026-53796 [MEDIUM] CWE-59 CVE-2026-53796: rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination

CVE-2026-53798 [MEDIUM] CWE-704 CVE-2026-53798: rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorre

CVE-2026-43617 [MEDIUM] CWE-289 CVE-2026-43617: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's ho Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to den

CVE-2026-70459 [MEDIUM] CWE-908 CVE-2026-70459: rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child proce rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type,

CVE-2026-53794 [MEDIUM] CWE-1284 CVE-2026-53794: rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configurat rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially

CVE-2026-44510 [MEDIUM] CWE-125 CVE-2026-44510: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv_files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully

CVE-2026-44507 [MEDIUM] CWE-863 CVE-2026-44507: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/re

CVE-2026-43620 [MEDIUM] CWE-125 CVE-2026-43620: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted en