Rsync versions prior to 3.5.0 contain a CRLF injection vulnerability in the name-converter uid/gid mapping interface. Local attackers can create user or group names containing newline characters, which are injected into the pipe-based line-oriented protocol used by the rsync daemon. This injection can cause the daemon to process attacker-influenced data as legitimate protocol input, leading to corruption of uid/gid mapping logic. The vulnerability is identified as CWE-93 and has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no vendor advisory or patch information available yet.

The vulnerability allows local attackers to forge protocol messages by injecting newline characters into user or group names. This can corrupt the uid/gid mapping logic within the rsync daemon, potentially affecting the integrity of user and group identification during synchronization processes. No evidence of remote exploitation or privilege escalation is provided. The impact is limited to local attackers who can create such names.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running rsync daemons with untrusted local user or group names that may contain newline characters. Monitor vendor communications for updates regarding patches or official mitigations.