Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 6 total.
Command and argument injection in rsync via unquoted peer- or host-controlled values (CVE-2026-53790)
rsync contains multiple injection vulnerabilities across four code paths - the RSYNC_CONNECT_PROG environment variable host substitution, daemon exec hook expansions, rsync-ssl hostspec handling, and remote-shell newl...
Fixed in 3.5.0
IP address spoofing in rsync daemon PROXY protocol handling (CVE-2026-53791)
When `proxy protocol = true` is configured, the rsync daemon (before 3.5.0) accepts PROXY protocol headers from clients connecting directly rather than through a trusted proxy. This allows unauthenticated remote attac...
Fixed in 3.5.0
Chroot inner-module escape via parent-component symlink in rsync (CVE-2026-53793)
rsync before 3.5.0 fails to properly confine paths when `use chroot = yes` is combined with a `/./ ` inner-module root: the kernel chroot constrains only the outer path, allowing a symlinked parent component inside th...
Fixed in 3.5.0
hosts deny access control bypass in rsync on DNS lookup failure (CVE-2026-70452)
rsync's `match_hostname()` function performs a forward DNS lookup of hostname tokens configured in `hosts deny` rules. When the lookup fails, the function returns "no match" - indistinguishable from a genuine non-matc...
Fixed in 3.5.0
Module-root escape via symlink in rsync daemon (CVE-2026-70460)
The rsync daemon resolves operator-supplied --partial-dir and --backup-dir option values by following symlinks that are owned by uid 0 or the daemon euid, without verifying that the resolved path remains within the mo...
Fixed in 3.5.0
Integer overflow in rsync compressed-token decoder enables remote memory disclosure (CVE-2026-44508)
The rsync receiver's compressed-token decoder accumulates a 32-bit signed counter without checking for overflow. A malicious sender can trigger this overflow and, with careful manipulation, extract data stored in memo...
Fixed in 3.4.3