Vulnerability-Lookup

RLSA-2026:67463 (CVE-2026-53783)

Vulnerability from osv_rocky – Published: 2026-09-15 12:08 – Updated: 2026-09-19 00:13 – Source website

Summary

Important: rsync security, bug fix, and enhancement update

Details

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
rsync: rsync: Authorization bypass via auth users directive parsing (CVE-2026-70463)
rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

Bug Fix(es) and Enhancement(s):

Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:67463	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2515368	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515373	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515375	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515378	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515379	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515380	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515381	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515384	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515385	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515386	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515387	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515389	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515395	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515396	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515403	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515406	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515407	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515409	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515416	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515417	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2515419	REPORT
	https://access.redhat.com/errata/RHSA-2026:67463	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "rsync",
        "purl": "pkg:rpm/rocky-linux/rsync?distro=rocky-linux-10\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:3.5.0-3.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:67463"
  },
  "details": "The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync 2.3.3 \u003c 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)\n\n* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)\n\n* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)\n\n* rsync: rsync \u003c 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)\n\n* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)\n\n* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)\n\n* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)\n\n* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)\n\n* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)\n\n* rsync: rsync 3.1.0 \u003c 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)\n\n* rsync: rsync \u003c 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)\n\n* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)\n\n* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)\n\n* rsync: rsync \u003c 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)\n\n* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)\n\n* rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)\n\n* rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)\n\n* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)\n\n* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)\n\n* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)\n\n* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:67463",
  "modified": "2026-09-19T00:13:56.032580Z",
  "published": "2026-09-15T12:08:56.876794Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:67463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515368"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515373"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515375"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515378"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515379"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515380"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515381"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515384"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515385"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515386"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515387"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515389"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515395"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515396"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515406"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515407"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515409"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515416"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515417"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515419"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:67463"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: rsync security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-53783",
    "CVE-2026-53784",
    "CVE-2026-53785",
    "CVE-2026-53789",
    "CVE-2026-53790",
    "CVE-2026-53791",
    "CVE-2026-53793",
    "CVE-2026-53795",
    "CVE-2026-53802",
    "CVE-2026-53803",
    "CVE-2026-70452",
    "CVE-2026-70453",
    "CVE-2026-70454",
    "CVE-2026-70455",
    "CVE-2026-70456",
    "CVE-2026-70457",
    "CVE-2026-70458",
    "CVE-2026-70460",
    "CVE-2026-70461",
    "CVE-2026-70463",
    "CVE-2026-70464"
  ]
}

CVE-2026-70464 (GCVE-0-2026-70464)

Vulnerability from cvelistv5 – Published: 2026-08-13 14:41 – Updated: 2026-08-14 16:51

Title

rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall

Summary

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:51 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

VulnCheck mitre root

References

3 references

URL	Tags
https://github.com/RsyncProject/rsync/security/ad…	vendor-advisory
https://github.com/RsyncProject/rsync/releases/ta…	release-notes
https://www.vulncheck.com/advisories/rsync-connec…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
RsyncProject	rsync	Affected: 2.0.0 , ≤ 3.4.4 (semver) Unaffected: 3.5.0 (semver) cpe:2.3:a:samba:rsync::::::::

Date Public

2026-08-12 00:00

Credits

mruprich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-70464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:51:09.213016Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:51:18.899Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/RsyncProject/rsync",
          "product": "rsync",
          "repo": "https://github.com/RsyncProject/rsync",
          "vendor": "RsyncProject",
          "versions": [
            {
              "lessThanOrEqual": "3.4.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.4.4",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "mruprich"
        }
      ],
      "datePublic": "2026-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ersync daemon 2.0.0 before 3.5.0\u0026nbsp;contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.\u003c/p\u003e"
            }
          ],
          "value": "rsync daemon 2.0.0 before 3.5.0\u00a0contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:51:26.225Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-hrwq-ccf7-rw5m)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m"
        },
        {
          "name": "rsync 3.5.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "rsync 2.0.0 \u003c 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-70464",
    "datePublished": "2026-08-13T14:41:47.987Z",
    "dateReserved": "2026-08-04T14:52:23.815Z",
    "dateUpdated": "2026-08-14T16:51:26.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.