rsync project reports:
This release fixes 33 security issues found during a focused audit of rsync's path
handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports
from external researchers -- plus several robustness hardenings. CVE IDs were assigned
by VulnCheck (CNA); the precise "introduced in" version ranges accompany each advisory,
and many are much narrower than "everything before 3.5.0". Every fix ships with a
regression test in the test suite that fails on the unfixed tree.
- CVE-2026-53802 (HIGH): Arbitrary file read / transfer-shaping via symlinked operator-supplied input files.
- CVE-2026-53803 (HIGH): Arbitrary file write / privilege escalation via symlinked operator-supplied output paths.
- CVE-2026-53785 (HIGH): Under --relative, the receiver's implied-parent creation (make_path()) built the parent chain with a plain mkdir() on the full path.
- CVE-2026-53784 (HIGH): Daemon module-root chdir escape under use chroot = no.
- CVE-2026-53793 (HIGH): Chroot /./ inner-module escape a symlinked parent component.
- CVE-2026-53795 (HIGH): An absolute --temp-dir or --link-dest disabled the receiver's rename/link confinement.
- CVE-2026-53796 (MEDIUM): A non-daemon receiver's one-time chdir() into the operator-named destination was not fully confined.
- CVE-2026-53797 (MEDIUM): A non-daemon sender opened each transferred file's content by path (leaf O_NOFOLLOW only).
- CVE-2026-53799 (MEDIUM): Receiver ACL/xattr metadata application followed a symlink race.
- CVE-2026-53800 (MEDIUM): Sender --remove-source-files unlink followed a parent-component symlink race.
- CVE-2026-53801 (MEDIUM): Sender/daemon directory-scan enumeration escaped the transfer root / module.
support/rrsync (the restricted SSH wrapper):
- CVE-2026-53783 (HIGH): rrsync restricted-directory escape.
Daemon protocol / identity:
- CVE-2026-53786 (MEDIUM): A client-supplied --filter merge file bypassed the module filter list.
- CVE-2026-53798 (MEDIUM): The daemon name converter mapped an unknown name to uid/gid 0.
- CVE-2026-53788 (MEDIUM): A peer-controlled name containing a newline/CR was written verbatim into the name-converter line protocol.
- CVE-2026-53789 (MEDIUM): A malicious daemon-sender could widen --delete scope by omitting the "no content dir" flag on an implied parent.
- CVE-2026-53791 (CRITICAL): With proxy protocol = true, a client connecting directly (not via the trusted proxy) could send a PROXY header to spoof its source address.
Injection and memory safety:
- CVE-2026-53790 (HIGH): Command / argument injection via unquoted peer- or host-controlled values the RSYNC_CONNECT_PROG %H host substitution.
- CVE-2026-53792 (MEDIUM): A malicious receiver sending a checksum header with a block count > 0 but block length == 0 drove the sender's rolling-match arithmetic negative.
- CVE-2026-53794 (MEDIUM): --max-alloc=0 disabled the per-allocation size cap.
Peer-triggerable memory corruption in the daemon protocol:
- CVE-2026-70461 (HIGH): a one-byte heap out-of-bounds write in add_implied_include().
- CVE-2026-70458 (HIGH): an out-of-bounds write from a file entry marked FLAG_HLINKED that the receiver accepted even though -H was not in effect.
- CVE-2026-70456 (HIGH): an out-of-bounds heap write in read_args() when the peer's argument count lands exactly on maxargs.
- CVE-2026-70457 (MEDIUM): an attacker-chosen-offset write in parse_size_arg()'s error formatting.
- CVE-2026-70459 (MEDIUM): a wild-pointer read crashing the per-connection daemon child.
Daemon availability and access control:
- CVE-2026-70464 (HIGH): an unauthenticated peer could complete the @RSYNCD greeting and then stall forever.
- CVE-2026-70455 (HIGH): a daemon client could request an arbitrary Zstandard worker count via --compress-threads.
- CVE-2026-70453 (HIGH): quadratic CPU exhaustion in hash_search() from a crafted chain of equal weak checksums.
- CVE-2026-70452 (HIGH): hosts deny failed OPEN when a configured hostname could not be resolved.
- CVE-2026-70463 (HIGH): auth users ignored its documented comma-only parsing.
- CVE-2026-70460 (HIGH): a peer-supplied --partial-dir or --backup-dir was resolved by pathname.
Client-side:
- CVE-2026-70462 (MEDIUM): a peer-supplied MSG_IO_TIMEOUT defeated the client's own I/O timeout.
- CVE-2026-70454 (MEDIUM): rsync-ssl established an unauthenticated TLS connection.