https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:30:54 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:67463 <p><strong>Affected:</strong> AlmaLinux:10: rsync, AlmaLinux:10: rsync-daemon, AlmaLinux:10: rsync-rrsync</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: rsync 2.3.3 &lt; 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync &lt; 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 &lt; 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync &lt; 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync &lt; 3.5.0 Path Confinemen…</p> <p><strong>Affected:</strong> AlmaLinux:10: rsync, AlmaLinux:10: rsync-daemon, AlmaLinux:10: rsync-rrsync</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: rsync 2.3.3 &lt; 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync &lt; 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 &lt; 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync &lt; 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync &lt; 3.5.0 Path Confinemen…</p> https://cve.radiocsirt.org/vuln/alsa-2026:67463 https://cve.radiocsirt.org/vuln/bdu:2026-14725 bdu:2026-14725 https://cve.radiocsirt.org/vuln/bdu:2026-14725 https://cve.radiocsirt.org/vuln/bell-cve-2026-70455 <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-70455 https://cve.radiocsirt.org/vuln/euvd-2026-352903 EUVD-2026-352903 https://cve.radiocsirt.org/vuln/euvd-2026-352903 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70455 <p>rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive&#39;s string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.</p> <p>rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive&#39;s string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-70455 https://cve.radiocsirt.org/vuln/msrc_cve-2026-70455 msrc_CVE-2026-70455 https://cve.radiocsirt.org/vuln/msrc_cve-2026-70455 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 <p>rsync-3.5.1-1.1 on GA media</p> <p>rsync-3.5.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11869-1 https://cve.radiocsirt.org/vuln/rlsa-2026:67463 <p><strong>Affected:</strong> Rocky Linux:10: rsync</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: rsync 2.3.3 &lt; 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)</p> <p>* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)</p> <p>* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)</p> <p>* rsync: rsync &lt; 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)</p> <p>* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)</p> <p>* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)</p> <p>* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)</p> <p>* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)</p> <p>* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)</p> <p>* rsync: rsync 3.1.0 &lt; 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)</p> <p>* rsync: rsync &lt; 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)</p> <p>* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)</p> <p>* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)</p> <p>* rsync: rsync &lt; 3.5.0 Path Confinement Bypass via /./ Bo…</p> <p><strong>Affected:</strong> Rocky Linux:10: rsync</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: rsync 2.3.3 &lt; 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)</p> <p>* rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)</p> <p>* rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)</p> <p>* rsync: rsync &lt; 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)</p> <p>* rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)</p> <p>* rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)</p> <p>* rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)</p> <p>* rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)</p> <p>* rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)</p> <p>* rsync: rsync 3.1.0 &lt; 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)</p> <p>* rsync: rsync &lt; 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)</p> <p>* rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)</p> <p>* rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)</p> <p>* rsync: rsync &lt; 3.5.0 Path Confinement Bypass via /./ Bo…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:67463 https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 <p>Security update for rsync</p> <p>Security update for rsync</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23253-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-70455 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync</p> <p>rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive&#39;s string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:26.04:LTS: rsync</p> <p>rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive&#39;s string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-70455 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817 <p>Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Rsync ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Denial-of-Service-Zustände herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2817