RsyncProject vulnerabilities and threats

A denial of service vulnerability exists in rsync daemon versions 2.0.0 through 3.4.4. Unauthenticated remote attackers can exhaust all daemon connection slots by stalling the handshake process either before or after module selection without triggering I/O timeouts. This allows attackers to consume resources and deny service to legitimate clients.

CVE-2026-70463 is an authorization bypass vulnerability in rsync versions 3.1.0 through 3.4.4. The flaw arises from incorrect parsing of the auth users directive, specifically when group names contain spaces. This causes deny rules associated with such groups to be discarded, allowing authenticated users who should be denied access to connect to restricted modules.

Rsync versions 3.1.0 through 3.4.4 contain a signed integer overflow vulnerability in the I/O timeout implementation. This flaw allows attackers to send crafted MSG_IO_TIMEOUT messages with zero or negative values, causing the timeout variable to wrap and disable connection timeouts. As a result, idle or stalled connections can occupy daemon slots indefinitely, leading to resource exhaustion.

A heap out-of-bounds write vulnerability exists in rsync versions 3.2.5 through 3.4.4. This flaw allows remote unauthenticated attackers to write one byte beyond a heap allocation by supplying a specially crafted files-from entry containing both an interior and trailing backslash. The vulnerability occurs in the add_implied_include() function, which miscalculates buffer size due to under-counting the trailing backslash. This issue affects read-only rsync daemon modules.

A path traversal vulnerability exists in rsync versions 2.3.3 through 3.4.4. This flaw allows a malicious sender to escape the intended module root directory by exploiting symbolic links when using the --partial-dir or --backup-dir options. An attacker with write access to place or leverage symlinks can cause arbitrary file writes outside the module root.

Rsync versions 3.0.0 through 3.4.4 contain a vulnerability where the daemon child process dereferences a null or uninitialized pointer when processing a specially crafted file list. This occurs if the first file list entry is a dot entry not typed as a directory, causing the daemon to crash and terminate the client connection.

CVE-2026-70458 is a high severity out-of-bounds write vulnerability in rsync versions 3.0.0 through 3.4.4. It occurs during processing of file entries with the FLAG_HLINKED flag when hard-link preservation is inactive, causing memory corruption due to missing F_SUM field in the file_struct layout. This flaw affects multiple Ubuntu LTS versions. No official patch or remediation guidance has been confirmed yet.

CVE-2026-70457 is a high-severity vulnerability in rsync versions 3.2.3 through 3.4.4. It involves an out-of-bounds write in the parse_size_arg() function due to incorrect handling of snprintf() return values. This can lead to memory corruption in the .bss segment.

An out-of-bounds write vulnerability exists in rsync versions 3.0.1 through 3.4.4 in the read_args() function. This flaw occurs when a crafted argument list causes the argv allocation to be exactly full, leading to a NULL terminator being written beyond the allocated boundary and corrupting adjacent heap memory. The vulnerability has a high severity with a CVSS score of 8.8.

Rsync versions 3.4.2 through 3.4.4 contain a denial of service vulnerability due to unbounded resource allocation. A remote attacker can exploit the --zt option (alias for --compress-threads) to spawn excessive Zstandard worker threads, exhausting system thread and memory resources. This bypasses the refuse options directive's string matching on long option names, allowing the attack to succeed without authentication or user interaction.

CVE-2026-70454 is a high-severity vulnerability in Rsync versions 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) involving improper TLS certificate validation. The flaw allows on-path attackers to intercept encrypted sessions by using self-signed or invalid certificates due to failure to properly validate server TLS certificates against trusted CAs and verify hostname matching. This can lead to decryption or tampering of rsync session content without client detection.

CVE-2026-70453 is an algorithmic complexity vulnerability in rsync versions up to 3.4.4. It affects the hash_search() function, allowing a remote attacker to cause a denial of service by sending a specially crafted file list. The vulnerability exploits quadratic-time worst-case behavior in hash lookups, leading to high CPU resource consumption on the receiver side.

Rsync versions 3.1.0 through 3.4.4 contain an access control bypass vulnerability due to improper handling of DNS resolution failures during hostname-based access control evaluation. When a DNS lookup fails for a hostname-based deny rule, the rsync daemon incorrectly skips the deny rule instead of denying access, allowing remote attackers to bypass IP-based access controls and gain unauthorized access to restricted module file trees.

CVE-2026-53803 is a symlink following vulnerability in rsync versions up to 3.4.4 that allows local attackers to overwrite arbitrary files by exploiting predictable output paths such as --log-file or --write-batch. This flaw can lead to local privilege escalation on systems where rsync runs with elevated privileges, including setuid or privileged daemon configurations.

CVE-2026-53802 is a high-severity vulnerability in rsync versions up to 3.4.4 that allows arbitrary file reading via symbolic link following in certain input configuration files. Attackers can exploit this by placing symlinks in predictable paths used by rsync daemon options such as --files-from, --password-file, and filter merge files, potentially reading any file accessible to the rsync process.

A symlink race condition vulnerability exists in rsync versions up to 3.4.4, allowing attackers who can manipulate symlinks in the sender's scanned directory tree to cause file enumeration and transfer outside the intended module root. This affects both daemon-mode and non-daemon sender-side scanning.

CVE-2026-53800 is a symlink race condition vulnerability in rsync versions up to 3.4.4 affecting the --remove-source-files feature. It allows an attacker who can create symbolic links to cause arbitrary file deletion by replacing a source file with a symlink between the file transfer and the removal step. This can result in unintended deletion of files pointed to by the symlink target instead of the intended source files.

A symlink race condition vulnerability exists in rsync versions up to 3.4.4 that allows local attackers to redirect the application of ACLs or extended attributes to unintended files by substituting a symlink during a timing window. This can lead to elevated permissions and local privilege escalation.

CVE-2026-53798 is a privilege confusion vulnerability in rsync versions up to 3.4.4. It arises from incorrect handling of uid/gid lookups in the name-converter subprocess, where empty responses are misinterpreted as root (uid/gid 0). This flaw allows local attackers to cause transferred files to be owned by root by manipulating the name-converter responses. The vulnerability has a medium severity with a CVSS score of 6.9.

A critical authentication bypass vulnerability exists in rsync daemon versions up to 3.4.4. This flaw allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address. Exploiting this vulnerability enables attackers who can connect to the rsync daemon to circumvent host allow/deny rules and gain unauthorized access that would normally be blocked based on their real source IP.