Rsync: 25 Vulnerabilities Disclosed Together, Affecting Versions Before 3.5.0
A coordinated disclosure on August 13, 2026, revealed 25 vulnerabilities in Rsync versions prior to 3.5.0, impacting security and stability.
Key findings
- 25 vulnerabilities disclosed for Rsync versions prior to 3.5.0 on August 13, 2026.
- Multiple vulnerabilities include heap corruption, path traversal, and DoS conditions.
- Access control bypasses and TOCTOU race conditions are among the disclosed flaws.
- Rsync version 3.5.0 addresses all vulnerabilities in this batch.
On August 13, 2026, a significant batch of 25 vulnerabilities was disclosed for Rsync, affecting versions prior to 3.5.0. These vulnerabilities, detailed in a coordinated disclosure, span a range of security risks including denial of service, authorization bypass, heap corruption, and path traversal. The sheer volume and variety of these flaws highlight critical weaknesses in Rsync's handling of network connections, file operations, and access control mechanisms, underscoring the need for immediate attention from administrators and users.
Several vulnerabilities center on denial-of-service (DoS) conditions. CVE-2026-70464 describes how unauthenticated remote attackers can exhaust daemon connection slots by stalling the handshake process, leading to a DoS. Similarly, CVE-2026-70453 exploits algorithmic complexity in the hash_search function, allowing attackers to consume CPU resources with carefully crafted file lists. CVE-2026-70455 details a DoS vulnerability where a crafted alias for --compress-threads bypasses refuse options, enabling attackers to specify large values and exhaust system resources. CVE-2026-70450, a null pointer dereference in the daemon child process, can crash the daemon when receiving a malformed file list. Finally, CVE-2026-53794 reveals a logic error in --max-alloc handling that disables allocation sanity checks, potentially leading to unbounded memory allocations.
Memory corruption vulnerabilities are also prevalent in this batch. CVE-2026-70461 describes a heap out-of-bounds write allowing attackers to write data past allocated heap memory by supplying a crafted files-from entry. CVE-2026-70458 details an out-of-bounds write during HLINK_BUMP processing that corrupts memory when hard-link preservation is inactive. CVE-2026-70457 points to an out-of-bounds write in parse_size_arg() due to improper handling of snprintf's return value, allowing attackers to write past array bounds. CVE-2026-70456 involves an out-of-bounds write in read_args() where a crafted argument list can corrupt adjacent heap memory. CVE-2026-53792 describes an out-of-bounds read in sender-side block matching, allowing a malicious receiver to trigger memory access before a buffer's start.
Path traversal and arbitrary file access vulnerabilities pose significant risks. CVE-2026-70460 details a path traversal vulnerability allowing attackers to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir. CVE-2026-53803 describes a symlink following vulnerability that allows local attackers to overwrite arbitrary files via predictable output paths like --log-file. CVE-2026-53802 enables arbitrary file reads by exploiting symlink following in input configuration files such as --files-from. CVE-2026-53795 allows attackers to write files outside the intended destination tree by specifying absolute paths via --temp-dir or --link-dest, bypassing rename-confinement logic. CVE-2026-53794, as mentioned earlier, can lead to unbounded memory allocations, indirectly impacting file handling. CVE-2026-53793 involves a privilege confusion vulnerability in uid/gid mapping that could lead to transferred files being owned by root. CVE-2026-53794 also includes a path confinement bypass when module roots contain '/./' boundary markers.
Several vulnerabilities relate to authorization and access control bypasses. CVE-2026-70463 describes an authorization bypass in auth users directive parsing where comma-only tokenization fails to handle group names with spaces correctly. CVE-2026-70452 details an access control bypass where induced DNS resolution failures during hostname-based access control evaluation cause the daemon to skip deny rules.
Time-of-check to time-of-use (TOCTOU) race conditions are present in multiple CVEs. CVE-2026-53801 and CVE-2026-53797 involve symlink race conditions in the sender's directory scanning and source tree traversal, respectively, allowing attackers to enumerate or read unintended files. CVE-2026-53800 describes a symlink race condition with --remove-source-files that can lead to arbitrary file deletion. CVE-2026-53799 allows local attackers to apply arbitrary ACLs or extended attributes to unintended files via symlink substitution. CVE-2026-53796 involves a TOCTOU race condition in the non-daemon receiver's destination directory handling, allowing attackers to redirect file writes to unintended locations.
Finally, CVE-2026-70455 addresses a DoS via resource exhaustion by exploiting a bypass of refuse options for --compress-threads. CVE-2026-70454 highlights a TLS certificate validation vulnerability in OpenSSL and stunnel modes, allowing on-path attackers to intercept encrypted sessions by presenting invalid certificates. CVE-2026-70462 involves a signed integer overflow in the I/O timeout implementation, allowing attackers to disable connection timeouts.
All these vulnerabilities affect Rsync versions prior to 3.5.0. Users are strongly advised to update to Rsync version 3.5.0 or later to mitigate these risks. The coordinated disclosure of these numerous flaws on a single day indicates a significant security audit or discovery event, emphasizing the critical need for prompt patching across all affected Rsync deployments.
The vulnerabilities disclosed on August 13, 2026, affect Rsync versions prior to 3.5.0. A significant number of these vulnerabilities are related to memory corruption, including heap out-of-bounds writes and reads. Path traversal and symlink following vulnerabilities allow for arbitrary file overwrites and reads. Denial-of-service conditions can be triggered through various means, including connection stalling and resource exhaustion. Access control and authorization bypasses are present, weakening security controls. TOCTOU race conditions are exploited in several CVEs, impacting file operations and security. Rsync version 3.5.0 is the patched version addressing this entire batch of vulnerabilities. CVE-2026-70464, CVE-2026-70463, CVE-2026-70462, CVE-2026-70461, CVE-2026-70460, CVE-2026-70459, CVE-2026-70458, CVE-2026-70457, CVE-2026-70456, CVE-2026-70455, CVE-2026-70454, CVE-2026-70453, CVE-2026-70452, CVE-2026-53803, CVE-2026-53802, CVE-2026-53801, CVE-2026-53800, CVE-2026-53799, CVE-2026-53798, CVE-2026-53797, CVE-2026-53796, CVE-2026-53795, CVE-2026-53794, CVE-2026-53793, CVE-2026-53792