Important: rsync security, bug fix, and enhancement update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793) * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453) * rsync: rsync: Information disclosure and denial of service via crafted files-from en
ALSA-2026:74095
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:ALSA-2026:74095
rsync
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.1.3-28.el8_10
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
rsync-daemon
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 3.1.3-28.el8_10
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.3-28.el8_10"
}
]
}
],
"package": {
"name": "rsync",
"purl": "pkg:rpm/almalinux/rsync",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:74095.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.3-28.el8_10"
}
]
}
],
"package": {
"name": "rsync-daemon",
"purl": "pkg:rpm/almalinux/rsync-daemon",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:74095.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #62468 · Revision 1
- Added to Heist Feed
- Publisher date