CVE-2024-12084

Rsync: heap buffer overflow in rsync due to improper checksum length handling

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

CVSS 3.1 · 9.8 Critical EPSS 72.5% KEV · Not listed

Vendors

Almalinux Archlinux Gentoo and 5 more

Products

Almalinux Arch Linux Linux and 7 more

CVE-2026-119741

rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2022-42898

krb5: integer overflow vulnerabilities in PAC parsing

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

CVSS 3.1 · 8.8 High EPSS 6.9% KEV · Not listed

Vendors

Heimdal Project Mit Redhat and 1 more

Products

Heimdal Kerberos 5 Enterprise Linux and 7 more

CVE-2024-12085

Rsync: info leak via uninitialized stack contents

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed

Vendors

Almalinux Archlinux Gentoo and 5 more

Products

Almalinux Arch Linux Linux and 26 more

CVE-2026-41035

rsync: Rsync: Use-after-free vulnerability in extended attribute handling

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Samba

Products

Rsync

CVE-2026-29518

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53789

rsync < 3.5.0 Arbitrary File Deletion via Malicious File List

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53784

rsync < 3.5.0 Path Traversal via Symlink Module Root

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53795

rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53786

rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70459

rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70455

rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70463

rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53799

rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53791

rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-53783

rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70464

rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70462

rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70461

rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-70460

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync