https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T12:24:16.732391+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:67463 ALSA-2026:67463 — Important: rsync security, bug fix, and enhancement update 2026-10-02T12:24:16.891455+00:00

Affected: AlmaLinux:10: rsync, AlmaLinux:10: rsync-daemon, AlmaLinux:10: rsync-rrsync

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinemen…

 https://cve.radiocsirt.org/vuln/bdu:2026-14725 bdu:2026-14725 2026-10-02T12:24:16.891538+00:00 bdu:2026-14725 https://cve.radiocsirt.org/vuln/bell-cve-2026-70455 BELL-CVE-2026-70455 2026-10-02T12:24:16.891556+00:00

Affected: Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync

 https://cve.radiocsirt.org/vuln/euvd-2026-352903 EUVD-2026-352903 2026-10-02T12:24:16.891579+00:00 EUVD-2026-352903 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70455 fkie_cve-2026-70455 2026-10-02T12:24:16.891590+00:00

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-70455 msrc_CVE-2026-70455 — rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion 2026-10-02T12:24:16.891615+00:00 msrc_CVE-2026-70455 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 openSUSE-SU-2026:11869-1 — rsync-3.5.1-1.1 on GA media 2026-10-02T12:24:16.891631+00:00

rsync-3.5.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rlsa-2026:67463 RLSA-2026:67463 — Important: rsync security, bug fix, and enhancement update 2026-10-02T12:24:16.891667+00:00

Affected: Rocky Linux:10: rsync

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)

* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

* rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)

* rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

* rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

* rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Bo…

 https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 SUSE-SU-2026:23253-1 — Security update for rsync 2026-10-02T12:24:16.891713+00:00

Security update for rsync

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-70455 UBUNTU-CVE-2026-70455 2026-10-02T12:24:16.891748+00:00

Affected: Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817 WID-SEC-W-2026-2817 — Rsync: Mehrere Schwachstellen 2026-10-02T12:24:16.891780+00:00

Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.