RHSA-2026:67462
Vulnerability from csaf_redhat - Published: 2026-09-14 19:43 - Updated: 2026-09-14 19:44Summary
Red Hat Security Advisory: rsync security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for rsync is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
* rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
* rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
* rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
* rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
* rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)
Bug Fix(es) and Enhancement(s):
* Rebase rsync to version 3.2.7 in RHEL9 (JIRA:RHEL-248835)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A time-of-check to time-of-use (TOCTOU) race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended boundary controls and read or write arbitrary files outside the designated directory.
8.1 (High)
Affected products
Fixed
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks during session initialization, causing subsequent operations to reference files relative to the symlink target, leading to unauthorized file access.
7.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory.
7.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a denial of service.
6.5 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Moderate
A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNC_CONNECT_PROG variable, daemon hooks, rsync-ssl, and remote-shell parsing—executing commands with the privileges of the running process or user.
8.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources.
7.4 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access to files outside the intended module's directory. This could lead to sensitive information disclosure or data manipulation.
7.4 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the `--temp-dir` or `--link-dest` options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption.
8.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by `--files-from` or `--password-file`. This allows the attacker to read arbitrary files accessible to the rsync daemon process, leading to information disclosure.
7.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges (such as setuid or a privileged daemon), this enables arbitrary file overwrites and local privilege escalation.
7.0 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees.
7.4 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the `hash_search()` function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service (DoS).
6.5 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Moderate
A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname matching, this interception occurs without detection by the client.
6.8 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Moderate
A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the `read_args()` function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code execution.
8.2 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
An out-of-bounds write vulnerability in rsync's parse_size_arg() function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf() truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and potentially compromise data integrity.
6.5 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Moderate
A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior.
8.2 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity
8.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer. This can lead to information disclosure or denial of service.
8.2 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain unauthorized access to restricted modules.
8.1 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
A denial of service flaw was found in the rsync daemon. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection slots, preventing legitimate clients from connecting.
7.5 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2026-53783
Threats
Impact
Important
References
141 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rsync is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)\n\n* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)\n\n* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)\n\n* rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)\n\n* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)\n\n* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)\n\n* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)\n\n* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)\n\n* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)\n\n* rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)\n\n* rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)\n\n* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)\n\n* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)\n\n* rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)\n\n* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)\n\n* rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)\n\n* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)\n\n* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)\n\n* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)\n\n* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase rsync to version 3.2.7 in RHEL9 (JIRA:RHEL-248835)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:67462",
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2515368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515368"
},
{
"category": "external",
"summary": "2515373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515373"
},
{
"category": "external",
"summary": "2515378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515378"
},
{
"category": "external",
"summary": "2515379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515379"
},
{
"category": "external",
"summary": "2515380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515380"
},
{
"category": "external",
"summary": "2515381",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515381"
},
{
"category": "external",
"summary": "2515384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515384"
},
{
"category": "external",
"summary": "2515385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515385"
},
{
"category": "external",
"summary": "2515386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515386"
},
{
"category": "external",
"summary": "2515387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515387"
},
{
"category": "external",
"summary": "2515389",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515389"
},
{
"category": "external",
"summary": "2515395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515395"
},
{
"category": "external",
"summary": "2515396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515396"
},
{
"category": "external",
"summary": "2515403",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515403"
},
{
"category": "external",
"summary": "2515409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515409"
},
{
"category": "external",
"summary": "2515417",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515417"
},
{
"category": "external",
"summary": "2515419",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515419"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67462.json"
}
],
"title": "Red Hat Security Advisory: rsync security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-09-14T19:44:46+00:00",
"generator": {
"date": "2026-09-14T19:44:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.21"
}
},
"id": "RHSA-2026:67462",
"initial_release_date": "2026-09-14T19:43:00+00:00",
"revision_history": [
{
"date": "2026-09-14T19:43:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-14T19:43:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-14T19:44:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:9::baseos"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.7-1.el9_8.src",
"product": {
"name": "rsync-0:3.2.7-1.el9_8.src",
"product_id": "rsync-0:3.2.7-1.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.7-1.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.7-1.el9_8.aarch64",
"product": {
"name": "rsync-0:3.2.7-1.el9_8.aarch64",
"product_id": "rsync-0:3.2.7-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.7-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"product": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"product_id": "rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.7-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"product": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"product_id": "rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.7-1.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.7-1.el9_8.ppc64le",
"product": {
"name": "rsync-0:3.2.7-1.el9_8.ppc64le",
"product_id": "rsync-0:3.2.7-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.7-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"product": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"product_id": "rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.7-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"product": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"product_id": "rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.7-1.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.7-1.el9_8.s390x",
"product": {
"name": "rsync-0:3.2.7-1.el9_8.s390x",
"product_id": "rsync-0:3.2.7-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.7-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"product": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"product_id": "rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.7-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"product": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"product_id": "rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.7-1.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-0:3.2.7-1.el9_8.x86_64",
"product": {
"name": "rsync-0:3.2.7-1.el9_8.x86_64",
"product_id": "rsync-0:3.2.7-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync@3.2.7-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debugsource-0:3.2.7-1.el9_8.x86_64",
"product": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.x86_64",
"product_id": "rsync-debugsource-0:3.2.7-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debugsource@3.2.7-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"product": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"product_id": "rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-debuginfo@3.2.7-1.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "rsync-daemon-0:3.2.7-1.el9_8.noarch",
"product": {
"name": "rsync-daemon-0:3.2.7-1.el9_8.noarch",
"product_id": "rsync-daemon-0:3.2.7-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-daemon@3.2.7-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"product": {
"name": "rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"product_id": "rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rsync-rrsync@3.2.7-1.el9_8?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-daemon-0:3.2.7-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch"
},
"product_reference": "rsync-daemon-0:3.2.7-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-rrsync-0:3.2.7-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch"
},
"product_reference": "rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.7-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64"
},
"product_reference": "rsync-0:3.2.7-1.el9_8.aarch64",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.7-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le"
},
"product_reference": "rsync-0:3.2.7-1.el9_8.ppc64le",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.7-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x"
},
"product_reference": "rsync-0:3.2.7-1.el9_8.s390x",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.7-1.el9_8.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src"
},
"product_reference": "rsync-0:3.2.7-1.el9_8.src",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-0:3.2.7-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64"
},
"product_reference": "rsync-0:3.2.7-1.el9_8.x86_64",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64"
},
"product_reference": "rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le"
},
"product_reference": "rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x"
},
"product_reference": "rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debuginfo-0:3.2.7-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64"
},
"product_reference": "rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64"
},
"product_reference": "rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le"
},
"product_reference": "rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x"
},
"product_reference": "rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rsync-debugsource-0:3.2.7-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)",
"product_id": "BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
},
"product_reference": "rsync-debugsource-0:3.2.7-1.el9_8.x86_64",
"relates_to_product_reference": "BaseOS-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-53783",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:14:11.047721+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515419"
}
],
"notes": [
{
"category": "description",
"text": "A time-of-check to time-of-use (TOCTOU) race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended boundary controls and read or write arbitrary files outside the designated directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Directory escape via TOCTOU race condition in rrsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important TOCTOU race condition in rsync\u0027s rrsync wrapper allows authenticated users to manipulate symlinks and escape directory boundaries, granting unauthorized read and write access to files outside the intended subtree.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53783"
},
{
"category": "external",
"summary": "RHBZ#2515419",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515419"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53783"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync",
"url": "https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync"
}
],
"release_date": "2026-08-13T14:34:07.144000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Do not use the rrsync SSH forced-command wrapper until patched packages are applied. If restricted rsync over SSH is strictly required, grant access only to SSH identities that are fully trusted with the host account\u0027s entire filesystem privileges, as rrsync cannot safely enforce directory boundaries. Note that standard rsync daemon firewall controls (TCP 873) do not mitigate this flaw, as execution occurs entirely over SSH (TCP 22).",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Directory escape via TOCTOU race condition in rrsync"
},
{
"cve": "CVE-2026-53784",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:12:09.260160+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515384"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This path traversal vulnerability allows remote clients to access files outside the intended module root. This occurs when the use chroot option is disabled and the module root path, or a component of it, is a symbolic link. The rsync daemon fails to resolve symlinks during session initialization, causing subsequent operations to reference files relative to the symlink target, leading to unauthorized file access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Unauthorized File Access via Symlink Module Root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. The rsync daemon is vulnerable to unauthorized file access via path traversal when configured with a symlinked module root and the `use chroot` option is explicitly disabled. This configuration is not default, but if present, a local attacker with low privileges could exploit this to read or write files outside the intended module root.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53784"
},
{
"category": "external",
"summary": "RHBZ#2515384",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515384"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53784"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root",
"url": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root"
}
],
"release_date": "2026-08-13T14:34:22.543000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that the `use chroot` option is enabled in the rsync daemon configuration. If `use chroot` cannot be enabled, avoid using symlinks as the module root path or any of its components in the rsync daemon configuration. After modifying the rsync configuration, restart the rsync service for the changes to take effect.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Unauthorized File Access via Symlink Module Root"
},
{
"cve": "CVE-2026-53785",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:14:03.538934+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515417"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability in rsync\u0027s --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary file write via path traversal in --relative mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in rsync where a malicious sender can achieve arbitrary file writes on a receiving system when the `--relative` mode is used. This path traversal flaw allows symlink components in relative paths to escape the intended destination directory. The risk is present in environments where rsync is configured to pull data from untrusted sources with the `--relative` option.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53785"
},
{
"category": "external",
"summary": "RHBZ#2515417",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515417"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53785"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53785",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53785"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode",
"url": "https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode"
}
],
"release_date": "2026-08-13T14:34:59.757000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid using the rsync --relative (-R) option when synchronizing with untrusted senders. Because kernel-level symlink protections cannot prevent rsync from following malicious destination-tree symlinks created by the same executing user, strict sender verification is required. Restricting --relative operations to fully trusted sources prevents attackers from exploiting implied relative paths to achieve path traversal.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Arbitrary file write via path traversal in --relative mode"
},
{
"cve": "CVE-2026-53789",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-08-13T15:11:39.753005+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515375"
}
],
"notes": [
{
"category": "description",
"text": "An improper path handling vulnerability in rsync allows a remote attacker to delete arbitrary files on the receiving system. By sending a specially crafted file list during synchronization, an attacker can expand the scope of --delete operations beyond the target directory, potentially causing a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary file deletion via malicious file list",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This flaw in rsync allows a malicious sender to delete arbitrary files on the receiving system when the `--delete` option is used. This impact is limited to scenarios where rsync is configured to synchronize data from an untrusted source with deletion enabled, potentially leading to data loss beyond the intended sync target.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53789"
},
{
"category": "external",
"summary": "RHBZ#2515375",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515375"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53789"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53789",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53789"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list",
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list"
}
],
"release_date": "2026-08-13T14:37:14.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To reduce the risk of arbitrary file deletion, ensure that rsync operations using the `--delete` option are only performed with trusted remote sources. If rsync is configured as a daemon (`rsyncd`), restrict network access to the rsync service (port 873/tcp) to only trusted clients using firewall rules. For example, using `firewall-cmd` on Red Hat Enterprise Linux:\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003cTRUSTED_IP_ADDRESS\u003e\" port port=\"873\" protocol=\"tcp\" accept\u0027`\n`firewall-cmd --reload`\nThis may impact legitimate rsync operations from untrusted networks. A service reload or restart may be required for changes to take effect.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: Arbitrary file deletion via malicious file list"
},
{
"cve": "CVE-2026-53790",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-13T15:11:43.321109+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515378"
}
],
"notes": [
{
"category": "description",
"text": "A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors\u2014including the RSYNC_CONNECT_PROG variable, daemon hooks, rsync-ssl, and remote-shell parsing\u2014executing commands with the privileges of the running process or user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in rsync allows for remote command injection due to insufficient sanitization of user-supplied input across multiple code paths. While the attack complexity is high, successful exploitation could lead to arbitrary command execution under the privileges of the rsync process or the invoking user, impacting confidentiality, integrity, and availability. This risk is particularly relevant in environments where rsync is used for remote synchronization with untrusted sources or destinations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53790"
},
{
"category": "external",
"summary": "RHBZ#2515378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515378"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53790"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths",
"url": "https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths"
}
],
"release_date": "2026-08-13T14:37:41.052000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Do not set RSYNC_CONNECT_PROG or pass untrusted hostnames/paths into rsync / rsync-ssl. If rsyncd is required, omit pre-xfer/post-xfer/early exec unless the command ignores client-controlled RSYNC_* values, and restrict TCP/873 to trusted clients",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths"
},
{
"cve": "CVE-2026-53791",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2026-08-13T15:12:20.428986+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515387"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the rsync daemon. When configured to use the PROXY protocol, an unauthenticated remote attacker can bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address. This allows unauthorized access to restricted resources.\n\nNote: Red Hat Enterprise Linux 8 and earlier versions do not contain the vulnerable PROXY protocol implementation and are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53791"
},
{
"category": "external",
"summary": "RHBZ#2515387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515387"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53791"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53791",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53791"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header",
"url": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header"
}
],
"release_date": "2026-08-13T14:38:10.300000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Restrict rsync daemon TCP/873 to the trusted proxy only (CME-202). If PROXY protocol is unused, leave proxy protocol disabled (the default).",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header"
},
{
"cve": "CVE-2026-53793",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:12:45.432498+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515396"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a \u0027/./\u0027 boundary marker within a chroot environment, an attacker can gain unauthorized read or write access to files outside the intended module\u0027s directory. This could lead to sensitive information disclosure or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important rsync flaw enables remote clients to bypass path confinement when the daemon operates in chroot mode with a module root containing a `/./` boundary marker. Successful exploitation could lead to unauthorized read and write access to files outside the intended chroot environment, though the attack complexity is high.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53793"
},
{
"category": "external",
"summary": "RHBZ#2515396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515396"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53793",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53793"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53793",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53793"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode",
"url": "https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode"
}
],
"release_date": "2026-08-13T14:38:42.288000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid configuring rsync modules with a /./ boundary marker in their root path when operating in chroot mode. Review existing rsync configurations to ensure that module root paths do not contain /./ when chroot is enabled. If chroot mode is not strictly required for a given rsync module, consider disabling it. If changes are made to the rsync configuration, a restart of the rsync service may be required for the changes to take effect.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode"
},
{
"cve": "CVE-2026-53795",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:12:23.902476+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515389"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the `--temp-dir` or `--link-dest` options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in rsync allows an attacker to write files to arbitrary locations outside the intended destination. This occurs when a user is tricked into executing rsync with attacker-controlled absolute paths via the `--temp-dir` or `--link-dest` options, bypassing path confinement. The requirement for user interaction to supply malicious input prevents this from being a Critical severity issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53795"
},
{
"category": "external",
"summary": "RHBZ#2515389",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515389"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53795"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest",
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest"
}
],
"release_date": "2026-08-13T14:39:26.044000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Do not pass untrusted values into --temp-dir or --link-dest. If you need those options, keep the destination (and those dirs) free of writes by untrusted users so a parent cannot be swapped to a symlink. Do not use --partial-dir or --inplace when pulling from an untrusted server. If rsyncd runs with use chroot = no, restrict who can connect.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options"
},
{
"cve": "CVE-2026-53802",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:13:49.762954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by `--files-from` or `--password-file`. This allows the attacker to read arbitrary files accessible to the rsync daemon process, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Arbitrary File Read via Symlink Following",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A symlink-following vulnerability in rsync allows a local, low-privileged attacker to read arbitrary files accessible to the rsync daemon. The issue occurs when rsync improperly handles input configuration files, such as --files-from or --password-file. Exploitation requires a non-default configuration where the attacker can either control the input file paths or plant symlinks within the daemon\u0027s module root.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53802"
},
{
"category": "external",
"summary": "RHBZ#2515416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53802"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53802",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53802"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following",
"url": "https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following"
}
],
"release_date": "2026-08-13T14:32:26.170000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Ensure the rsync daemon runs with the principle of least privilege, enabling use chroot = yes to securely jail the process to its module tree. Restrict write access for daemon configuration directories and files specified by --files-from or --password-file to trusted administrators only. When running rsync outside of daemon mode, ensure users only process input files originating from trusted, non-world-writable directories.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Arbitrary File Read via Symlink Following"
},
{
"cve": "CVE-2026-53803",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:11:51.112693+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515381"
}
],
"notes": [
{
"category": "description",
"text": "A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges (such as setuid or a privileged daemon), this enables arbitrary file overwrites and local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Local Privilege Escalation via Symlink Following",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in rsync allows a local attacker to achieve privilege escalation by exploiting a symlink following flaw. In Red Hat environments, the risk is elevated when rsync is configured to run with elevated privileges, such as setuid or in daemon mode, enabling an attacker to overwrite arbitrary files. The requirement for local access and specific privileged configurations prevents a Critical impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53803"
},
{
"category": "external",
"summary": "RHBZ#2515381",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515381"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53803"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53803",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53803"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite",
"url": "https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite"
}
],
"release_date": "2026-08-13T14:33:18.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Do not run rsync setuid or point output paths (--log-file, --write-batch, or daemon config/log files) to user-writable directories like /tmp. While fs.protected_symlinks=1 prevents simple symlink creation in sticky directories on RHEL 7+, it does not stop parent-component attacks in standard directories. If the rsyncd daemon is unneeded, disable it (systemctl disable --now rsyncd); if required, enforce least-privilege execution and restrict network access to trusted hosts.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Local Privilege Escalation via Symlink Following"
},
{
"cve": "CVE-2026-70452",
"cwe": {
"id": "CWE-636",
"name": "Not Failing Securely (\u0027Failing Open\u0027)"
},
"discovery_date": "2026-08-13T15:12:16.691954+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515386"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in rsync allows remote attackers to bypass hostname-based access controls. By inducing DNS resolution failures, an attacker can circumvent `hosts deny` rules, potentially gaining unauthorized access to restricted rsync module file trees on systems configured with hostname-based access controls and exposed to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70452"
},
{
"category": "external",
"summary": "RHBZ#2515386",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515386"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70452"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70452",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70452"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure",
"url": "https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure"
}
],
"release_date": "2026-08-13T14:46:50.541000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure rsync to use IP-based access controls instead of hostname-based rules in `rsyncd.conf`. Alternatively, restrict network access to the rsync daemon using firewall rules to allow connections only from trusted IP addresses or networks. This limits exposure by preventing untrusted remote attackers from reaching the service and attempting to induce DNS resolution failures. If changes are made to `rsyncd.conf`, the rsync daemon may need to be restarted or reloaded for the changes to take effect.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure"
},
{
"cve": "CVE-2026-70453",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T15:13:16.902780+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515403"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the `hash_search()` function by sending a specially crafted file list. This can lead to the exhaustion of the receiver\u0027s CPU resources, causing a sustained denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Denial of Service via Algorithmic Complexity",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in rsync\u0027s `hash_search()` function allows a remote attacker to cause a denial of service. By sending a specially crafted file list, an attacker can exhaust the receiver\u0027s CPU resources, leading to service unavailability. This is particularly relevant in Red Hat environments where rsync is used for remote file synchronization and may be exposed to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70453"
},
{
"category": "external",
"summary": "RHBZ#2515403",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515403"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70453"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search",
"url": "https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search"
}
],
"release_date": "2026-08-13T14:46:20.696000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Disable unused rsyncd services (systemctl disable --now rsyncd), or restrict daemon access to trusted clients via hosts allow and firewall rules. Avoid synchronizing with untrusted senders or pushing to untrusted receivers and upload modules to prevent processing malicious file lists. To contain potential Denial of Service, enforce CPU resource limits on rsync processes using systemd cgroups or ulimit -t to prevent a quadratic search walk from starving the host.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: Denial of Service via Algorithmic Complexity"
},
{
"cve": "CVE-2026-70454",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-13T15:11:36.561905+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the rsync-ssl wrapper script\u0027s TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname matching, this interception occurs without detection by the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in rsync allows on-path attackers to intercept and tamper with encrypted sessions. The vulnerability arises from insufficient TLS certificate validation, enabling an attacker to present invalid certificates and compromise data integrity and confidentiality without detection. Exploitation requires an attacker to be positioned to intercept network traffic between the rsync client and server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70454"
},
{
"category": "external",
"summary": "RHBZ#2515373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70454"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70454",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70454"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode",
"url": "https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode"
}
],
"release_date": "2026-08-13T14:45:39.599000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Do not use rsync-ssl with the openssl or stunnel backends. Use rsync over SSH, which authenticates the host and encrypts the session: rsync -avz -e ssh /source user@remote:/destination. If daemon TLS cannot be avoided, restrict those sessions to trusted networks",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions"
},
{
"cve": "CVE-2026-70456",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:12:42.109177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the `read_args()` function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Heap Out-of-Bounds Write via crafted argument list",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important severity flaw in rsync, allowing a remote attacker to corrupt heap memory via a specially crafted argument list. The vulnerability, exploitable without authentication or user interaction, could lead to denial of service or potentially arbitrary code execution, elevating its impact beyond Moderate due to the remote, unauthenticated nature of the attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70456"
},
{
"category": "external",
"summary": "RHBZ#2515395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70456"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args",
"url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args"
}
],
"release_date": "2026-08-13T14:44:56.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to rsync services to trusted hosts and networks using firewall rules. If rsync is used in daemon mode, configure `rsyncd.conf` to limit access. When using rsync as a client, avoid synchronizing with untrusted rsync servers.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Heap Out-of-Bounds Write via crafted argument list"
},
{
"cve": "CVE-2026-70457",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:13:26.653151+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515407"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in rsync\u0027s parse_size_arg() function allows a remote attacker to cause memory corruption. The flaw is triggered when snprintf() truncates a formatted size string, resulting in an incorrect memory array index. Exploitation can lead to a denial of service and potentially compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Memory corruption via out-of-bounds write in size parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in rsync stems from an out-of-bounds write in the `parse_size_arg()` function. Although no privileges or user interaction are required, the high attack complexity indicates that exploitation is not straightforward. Successful exploitation could lead to memory corruption, potentially causing a denial of service or compromising data integrity on affected Red Hat systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70457"
},
{
"category": "external",
"summary": "RHBZ#2515407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70457"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70457",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70457"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg",
"url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg"
}
],
"release_date": "2026-08-13T14:44:30.104000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "If rsync is configured to run as a daemon, restrict network access to trusted hosts using firewall rules. For example, to limit access to localhost:\n`firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"873\" protocol=\"tcp\" source address=\"127.0.0.1\" accept\u0027`\n`firewall-cmd --reload`\nThis may impact legitimate remote rsync operations. If rsync is not used as a daemon, ensure that only trusted sources are used for rsync operations.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: rsync: Memory corruption via out-of-bounds write in size parsing"
},
{
"cve": "CVE-2026-70458",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:11:58.147295+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515379"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Memory corruption via crafted file entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important out-of-bounds write vulnerability in rsync can lead to memory corruption when processing specially crafted file entries, potentially resulting in a denial of service. The flaw is triggered when hard-link preservation is inactive, allowing a remote attacker to exploit it without requiring user interaction or elevated privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70458"
},
{
"category": "external",
"summary": "RHBZ#2515379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515379"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70458"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling",
"url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling"
}
],
"release_date": "2026-08-13T14:44:06.034000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Disable the rsyncd daemon if unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. For daemons that must remain active, explicitly set refuse options = checksum in rsyncd.conf to block the demonstrated out-of-bounds write vector. Finally, when operating as a client pulling from untrusted peers, always append the --hard-links (-H) flag to force safe memory allocation and prevent corruption.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Memory corruption via crafted file entries"
},
{
"cve": "CVE-2026-70460",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-08-13T15:11:11.811994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515368"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in rsync that allows for path traversal. Exploitation requires a malicious sender to utilize the --partial-dir or --backup-dir options and the ability to create or leverage symlinks within the rsync module\u0027s file tree. This could lead to arbitrary file writes outside the intended module root.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70460"
},
{
"category": "external",
"summary": "RHBZ#2515368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70460"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70460",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70460"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink",
"url": "https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink"
}
],
"release_date": "2026-08-13T14:43:06.250000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Disable the rsyncd daemon if it is unused (systemctl disable --now rsyncd), or strictly limit TCP/873 access to trusted clients via firewall rules. Within rsyncd.conf, block the exploit vectors directly by setting refuse options = partial-dir backup-dir and maintain defense-in-depth by enforcing use chroot = yes. Finally, ensure no root- or daemon-owned symlinks point outside your module paths, and avoid using the vulnerable flags when operating as a client against untrusted sources.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink"
},
{
"cve": "CVE-2026-70461",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-13T15:13:29.709116+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515409"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer. This can lead to information disclosure or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Information disclosure and denial of service via crafted files-from entry",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in rsync that allows remote unauthenticated attackers to achieve information disclosure and denial of service. The flaw occurs in the rsync daemon when processing a specially crafted `files-from` entry, leading to a heap out-of-bounds write. This can be exploited against read-only rsync daemon modules, making it a significant risk for publicly exposed rsync services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70461"
},
{
"category": "external",
"summary": "RHBZ#2515409",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515409"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70461"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70461",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70461"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry",
"url": "https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry"
}
],
"release_date": "2026-08-13T14:42:49.726000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Restrict access to the rsync daemon (TCP 873) to trusted hosts with firewall rules. If the daemon is unused, disable and stop rsyncd.service.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Information disclosure and denial of service via crafted files-from entry"
},
{
"cve": "CVE-2026-70463",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"discovery_date": "2026-08-13T15:12:13.215909+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515385"
}
],
"notes": [
{
"category": "description",
"text": "An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain unauthorized access to restricted modules.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Authorization bypass via `auth users` directive parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important authorization bypass in rsync, affecting configurations that utilize the `auth users` directive with group names containing spaces. The flaw allows an authenticated, but unauthorized, user to access restricted rsync modules due to incorrect parsing of deny rules. This bypass occurs because the rsync parser fails to properly tokenize group names with embedded spaces, silently discarding intended access restrictions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70463"
},
{
"category": "external",
"summary": "RHBZ#2515385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515385"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70463"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70463",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70463"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing",
"url": "https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing"
}
],
"release_date": "2026-08-13T14:42:07.126000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "To prevent this authorization bypass, ensure that no group names containing spaces are used within the `auth users` directive in the `rsyncd.conf` configuration file. Review and update any existing configurations to remove spaces from group names in this directive. After making changes, restart the `rsync` service for the new configuration to take effect. For example, use `systemctl restart rsyncd` if managing the service with systemd. Note that restarting the service will temporarily interrupt active rsync operations.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Authorization bypass via `auth users` directive parsing"
},
{
"cve": "CVE-2026-70464",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T15:12:01.742340+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515380"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in the rsync daemon. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection slots, preventing legitimate clients from connecting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: rsync: Denial of Service via handshake stall",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An unauthenticated remote attacker can exhaust available connection slots by stalling the handshake process, preventing legitimate clients from connecting. This vulnerability primarily affects systems where the rsync daemon is explicitly enabled and exposed to untrusted networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-70464"
},
{
"category": "external",
"summary": "RHBZ#2515380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515380"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-70464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-70464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-70464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70464"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
},
{
"category": "external",
"summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m",
"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall",
"url": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall"
}
],
"release_date": "2026-08-13T14:41:47.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-14T19:43:00+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67462"
},
{
"category": "workaround",
"details": "Disable the rsync daemon if unused (systemctl disable --now rsyncd), or strictly restrict TCP/873 access to trusted clients using firewall rules and hosts allow directives. Do not rely on standard module timeout settings, as they do not protect against this specific pre-handshake stall. While configuring system limits (TasksMax/LimitNOFILE) can prevent full host resource exhaustion, aggressive IP-based connection filtering is the only reliable way to keep the targeted rsync module available.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:rsync-daemon-0:3.2.7-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:rsync-rrsync-0:3.2.7-1.el9_8.noarch",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.src",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debuginfo-0:3.2.7-1.el9_8.x86_64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.aarch64",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.ppc64le",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.s390x",
"BaseOS-9.8.0.Z.MAIN.EUS:rsync-debugsource-0:3.2.7-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rsync: rsync: Denial of Service via handshake stall"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…