Issued at: 2026-10-01
Updated at: 2026-10-02
Advisory content derived from Red Hat RHSA-2026:74095, © Red Hat, Inc., used under CC BY 4.0, with modifications.
Synopsis
Important: rsync security, bug fix, and enhancement update
Description
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
* rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
* rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
* rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
* rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
* rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
* rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
* rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
* rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)
Bug Fix(es) and Enhancement(s):
* Fix latest CVEs in rsync in Rocky Linux8 (JIRA:Rocky Linux-256903)
* rsync-3.1.3-27.el8_10 regression: rsync daemon rejects legitimate cross-device symlinks with EXDEV when use chroot = no (JIRA:Rocky Linux-239553)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.