Rsyncproject Rsync
43 CVEs affecting Rsyncproject Rsync. Latest disclosed: 2026-08-13. Critical: 1, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53791 | Critical | 9.1 | 2026-08-13 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by send… |
CVE-2026-70461 | High | 8.2 | 2026-08-13 | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte p… |
CVE-2026-70458 | High | 8.2 | 2026-08-13 | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entr… |
CVE-2026-70456 | High | 8.2 | 2026-08-13 | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memo… |
CVE-2026-70463 | High | 8.1 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting th… |
CVE-2026-70460 | High | 8.1 | 2026-08-13 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the mod… |
CVE-2026-53795 | High | 8.1 | 2026-08-13 | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an a… |
CVE-2026-53790 | High | 8.1 | 2026-08-13 | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious i… |
CVE-2026-53783 | High | 8.1 | 2026-08-13 | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticat… |
CVE-2026-43618 | High | 8.1 | 2026-05-20 | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overfl… |
CVE-2026-70454 | High | 8.0 | 2026-08-13 | rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path atta… |
CVE-2026-53803 | High | 7.8 | 2026-08-13 | rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable ou… |
CVE-2026-70464 | High | 7.5 | 2026-08-13 | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by s… |
CVE-2026-70455 | High | 7.5 | 2026-08-13 | rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias… |
CVE-2026-70453 | High | 7.5 | 2026-08-13 | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by… |
CVE-2026-70452 | High | 7.4 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution… |
CVE-2026-53793 | High | 7.4 | 2026-08-13 | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by construc… |
CVE-2026-53802 | High | 7.1 | 2026-08-13 | rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symli… |
CVE-2026-53785 | High | 7.1 | 2026-08-13 | rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by cra… |
CVE-2026-53784 | High | 7.1 | 2026-08-13 | rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disab… |