Skip to content
OpenAdvisories
High WID-SEC-2026-2817 37 CVEs

Rsync: Mehrere Schwachstellen

Published Aug 12, 2026 · Updated Nov 8, 2026 · Revision 20 · de

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: Fedora Vendor: Google Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Product: Avamar Product: Container-Optimized OS Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: NetWorker Product: openshift Product: openSUSE Product: QRadar SIEM Product: Rocky Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.

Product

Rsync ist ein Tool, um Dateien und Verzeichnisse zu synchronisieren.

Vulnerabilities 37

  • Critical 9.8
    CVE-2024-12084 Public exploit EPSS 73%

    Rsync: heap buffer overflow in rsync due to improper checksum length handling

    A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of b…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-53791

    rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

    rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.2
    CVE-2026-70456

    rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()

    rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exac…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.2
    CVE-2026-70458

    rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling

    rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers ca…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.2
    CVE-2026-70461

    rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

    rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-53783

    rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

    rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-53790

    rsync < 3.5.0 Command Injection via Multiple Code Paths

    rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-53795

    rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest

    rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when th…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-70460

    rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

    rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-70463 Public exploit

    rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

    rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name co…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 8.0
    CVE-2026-70454

    rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode

    rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. A…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.8
    CVE-2026-53803

    rsync < 3.5.0 Symlink Following Arbitrary File Overwrite

    rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-70453

    rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()

    rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case be…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-70455

    rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

    rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-70464

    rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall

    rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. A…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2026-53793

    rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

    rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary mar…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2026-70452

    rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

    rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based de…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-53784

    rsync < 3.5.0 Path Traversal via Symlink Module Root

    rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the modu…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-53785

    rsync < 3.5.0 Path Traversal Write Escape via --relative Mode

    rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows sy…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-53802

    rsync < 3.5.0 Arbitrary File Read via Symlink Following

    rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filte…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-43620

    Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()

    Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURS…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-53786

    rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

    rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-53788

    rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

    rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-53789

    rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

    rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-53792

    rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block

    rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-70457

    rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()

    rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return val…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-70462

    rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

    rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2026-43619

    Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls

    Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files o…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2026-53796

    rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling

    rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2026-53799

    rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

    rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-53801

    rsync < 3.5.0 Symlink Race Condition Directory Traversal

    rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manip…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-53794

    rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error

    rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the rece…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-53798

    rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

    rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When th…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-70459

    rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry

    rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences t…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 4.8
    CVE-2026-43617

    Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

    Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for thei…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 4.7
    CVE-2026-53797

    rsync < 3.5.0 Symlink Race Condition Information Disclosure

    rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically repl…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 4.7
    CVE-2026-53800

    rsync < 3.5.0 Symlink Race Condition via --remove-source-files

    rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file betwee…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine

Revision history

  1. #20

    Neue Updates von Debian aufgenommen

  2. #19

    Neue Updates von Red Hat aufgenommen

  3. #18

    Neue Updates von IBM aufgenommen

  4. #17

    Neue Updates von Red Hat aufgenommen

  5. #16

    Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

  6. #15

    Neue Updates von Red Hat aufgenommen

  7. #14

    Neue Updates von Red Hat aufgenommen

  8. #13

    Neue Updates von Debian und Amazon aufgenommen

  9. #12

    Neue Updates von Oracle Linux aufgenommen

  10. #11

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  11. #10

    Neue Updates von Red Hat aufgenommen

  12. #9

    Neue Updates von SUSE aufgenommen

  13. #8

    Neue Updates von SUSE und Dell aufgenommen

  14. #7

    Neue Updates von SUSE aufgenommen

  15. #6

    Neue Updates von openSUSE aufgenommen

  16. #5

    Neue Updates von SUSE aufgenommen

  17. #4

    Neue Updates von Fedora aufgenommen

  18. #3

    Neue Updates von SUSE aufgenommen

  19. #2

    Referenz(en) aufgenommen: EUVD-2026-58088, EUVD-2026-58092, EUVD-2026-58052, EUVD-2026-58051, EUVD-2026-58050, EUVD-2026-58049, EUVD-2026-58048, EUVD-2026-58047, EUVD-2026-58046, EUVD-2026-58045, EUVD-2026-58044, EUVD-2026-58042, EUVD-2026-58041, EUVD-2026-58040, EUVD-2026-58039, EUVD-2026-58038, EUVD-2026-58037, EUVD-2026-58036, EUVD-2026-58035, EUVD-2026-58034, EUVD-2026-58033, EUVD-2026-58100, EUVD-2026-58099, EUVD-2026-58098, EUVD-2026-58096, EUVD-2026-58097, EUVD-2026-58090, EUVD-2026-58094, EUVD-2026-58091, EUVD-2026-58089, EUVD-2026-58043, EUVD-2026-58101, EUVD-2026-58093

  20. #1

    Initiale Fassung

References