rsync
RsyncProject- Software type
- —
- Catalog vulnerabilities
- 43
Severity across 39 analyzed records
Verify to analyze this security profile
A short verification protects source data and prevents automated AI requests.
en
Severity across 39 analyzed records
A short verification protects source data and prevents automated AI requests.
As of 09/11/2026, within CyStack's analyzed data, rsync has 33 security vulnerabilities published in the last 90 days. Of these, 24 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of rsync and determine which vulnerabilities affect that version.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-70452rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityCritical |
CVE-2026-70453rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70454rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70455rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70456rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70457rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70458rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70459rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-70460rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityCritical |
CVE-2026-70461rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70462rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70463rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-70464rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53801rsync < 3.5.0 Symlink Race Condition Directory Traversal | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53800rsync < 3.5.0 Symlink Race Condition via --remove-source-files | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53799rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53797rsync < 3.5.0 Symlink Race Condition Information Disclosure | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53796rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53795rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53794rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53793rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityCritical |
CVE-2026-53792rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53791rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityCritical |
CVE-2026-53790rsync < 3.5.0 Command Injection via Multiple Code Paths | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityCritical |
CVE-2026-53789rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53788rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53798rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53786rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53785rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityMedium |
CVE-2026-53784rsync < 3.5.0 Path Traversal via Symlink Module Root | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53783rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53803rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-53802rsync < 3.5.0 Arbitrary File Read via Symlink Following | Exploitation statusNot known exploited | FixYes | Published08/13/2026 | SeverityHigh |
CVE-2026-44510CVE-2026-44510 | Exploitation statusNot confirmed | FixNot confirmed | Published07/20/2026 | SeverityUnknown |
CVE-2026-44508CVE-2026-44508 | Exploitation statusNot confirmed | FixNot confirmed | Published07/20/2026 | SeverityUnknown |
CVE-2026-44507CVE-2026-44507 | Exploitation statusNot confirmed | FixNot confirmed | Published07/20/2026 | SeverityUnknown |
CVE-2026-44509CVE-2026-44509 | Exploitation statusNot confirmed | FixNot confirmed | Published07/20/2026 | SeverityUnknown |
CVE-2026-29518Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write | Exploitation statusNot known exploited | FixYes | Published05/20/2026 | SeverityHigh |
CVE-2026-43617Rsync < 3.4.3 Authorization Bypass via Hostname Resolution | Exploitation statusNot known exploited | FixYes | Published05/20/2026 | SeverityMedium |
CVE-2026-43618Rsync < 3.4.3 Integer Overflow Information Disclosure | Exploitation statusNot known exploited | FixYes | Published05/20/2026 | SeverityMedium |
CVE-2026-43619Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls | Exploitation statusNot known exploited | FixYes | Published05/20/2026 | SeverityHigh |
CVE-2026-43620Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files() | Exploitation statusNot known exploited | FixYes | Published05/20/2026 | SeverityMedium |
CVE-2026-45232Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy | Exploitation statusNot known exploited | FixYes | Published05/20/2026 | SeverityLow |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan