# ALAS2023-2026-3131: Security update for 4 packages

ALAS2023-2026-3131, released September 28, 2026, fixes 37 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/alas2023-2026-3131
- Platform: Linux
- Released: Sep 28, 2026
- Priority: Urgent (Closes CVE-2026-53791, rated Critical)
- CVEs: 37, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://alas.aws.amazon.com/AL2023/ALAS-2026-3131.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [rsync](https://patchblox.com/security/data/product/linux/rsync.md) | amzn 2023 | 3.5.1-1.amzn2023.0.1 |
| [rsync-daemon](https://patchblox.com/security/data/product/linux/rsync-daemon.md) | amzn 2023 | 3.5.1-1.amzn2023.0.1 |
| [rsync-debuginfo](https://patchblox.com/security/data/product/linux/rsync-debuginfo.md) | amzn 2023 | 3.5.1-1.amzn2023.0.1 |
| [rsync-debugsource](https://patchblox.com/security/data/product/linux/rsync-debugsource.md) | amzn 2023 | 3.5.1-1.amzn2023.0.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53791](https://patchblox.com/security/data/cve/CVE-2026-53791.md) | Urgent | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 |  |
| [CVE-2026-70460](https://patchblox.com/security/data/cve/CVE-2026-70460.md) | Urgent | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 |  |
| [CVE-2026-70452](https://patchblox.com/security/data/cve/CVE-2026-70452.md) | Urgent | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0044 |  |
| [CVE-2026-70464](https://patchblox.com/security/data/cve/CVE-2026-70464.md) | High | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 |  |
| [CVE-2026-53790](https://patchblox.com/security/data/cve/CVE-2026-53790.md) | High | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 |  |
| [CVE-2026-70453](https://patchblox.com/security/data/cve/CVE-2026-70453.md) | High | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0059 |  |
| [CVE-2026-70461](https://patchblox.com/security/data/cve/CVE-2026-70461.md) | High | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 |  |
| [CVE-2026-70456](https://patchblox.com/security/data/cve/CVE-2026-70456.md) | High | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0044 |  |
| [CVE-2026-70458](https://patchblox.com/security/data/cve/CVE-2026-70458.md) | High | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0044 |  |
| [CVE-2026-53783](https://patchblox.com/security/data/cve/CVE-2026-53783.md) | High | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0043 |  |
| [CVE-2026-53795](https://patchblox.com/security/data/cve/CVE-2026-53795.md) | High | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 |  |
| [CVE-2026-70457](https://patchblox.com/security/data/cve/CVE-2026-70457.md) | High | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 |  |
| [CVE-2026-53793](https://patchblox.com/security/data/cve/CVE-2026-53793.md) | High | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0037 |  |
| [CVE-2026-70463](https://patchblox.com/security/data/cve/CVE-2026-70463.md) | High | rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing | 8.2 | 0.0036 |  |
| [CVE-2026-53789](https://patchblox.com/security/data/cve/CVE-2026-53789.md) | High | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 |  |
| [CVE-2026-53784](https://patchblox.com/security/data/cve/CVE-2026-53784.md) | High | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 |  |
| [CVE-2026-53802](https://patchblox.com/security/data/cve/CVE-2026-53802.md) | High | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 |  |
| [CVE-2026-53785](https://patchblox.com/security/data/cve/CVE-2026-53785.md) | High | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0024 |  |
| [CVE-2026-53803](https://patchblox.com/security/data/cve/CVE-2026-53803.md) | High | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 |  |
| [CVE-2026-70454](https://patchblox.com/security/data/cve/CVE-2026-70454.md) | High | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 |  |
| [CVE-2026-29518](https://patchblox.com/security/data/cve/CVE-2026-29518.md) | High | Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write | 8.1 | 0.0015 |  |
| [CVE-2026-70459](https://patchblox.com/security/data/cve/CVE-2026-70459.md) | Routine | rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry | 5.3 | 0.0072 |  |
| [CVE-2026-53794](https://patchblox.com/security/data/cve/CVE-2026-53794.md) | Routine | rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error | 5.3 | 0.0057 |  |
| [CVE-2026-43620](https://patchblox.com/security/data/cve/CVE-2026-43620.md) | Routine | Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files() | 6.5 | 0.0043 |  |
| [CVE-2026-53798](https://patchblox.com/security/data/cve/CVE-2026-53798.md) | Routine | rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping | 5.3 | 0.0043 |  |
| [CVE-2026-53786](https://patchblox.com/security/data/cve/CVE-2026-53786.md) | Routine | rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive | 6.5 | 0.0040 |  |
| [CVE-2026-53792](https://patchblox.com/security/data/cve/CVE-2026-53792.md) | Routine | rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block | 6.5 | 0.0035 |  |
| [CVE-2026-45232](https://patchblox.com/security/data/cve/CVE-2026-45232.md) | Routine | Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy | 3.7 | 0.0034 |  |
| [CVE-2026-53788](https://patchblox.com/security/data/cve/CVE-2026-53788.md) | Routine | rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping | 6.5 | 0.0030 |  |
| [CVE-2026-70462](https://patchblox.com/security/data/cve/CVE-2026-70462.md) | Routine | rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT | 6.5 | 0.0029 |  |
| [CVE-2026-53801](https://patchblox.com/security/data/cve/CVE-2026-53801.md) | Routine | rsync < 3.5.0 Symlink Race Condition Directory Traversal | 5.9 | 0.0029 |  |
| [CVE-2026-43617](https://patchblox.com/security/data/cve/CVE-2026-43617.md) | Routine | Rsync < 3.4.3 Authorization Bypass via Hostname Resolution | 4.8 | 0.0028 |  |
| [CVE-2026-53796](https://patchblox.com/security/data/cve/CVE-2026-53796.md) | Routine | rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling | 6.3 | 0.0015 |  |
| [CVE-2026-53797](https://patchblox.com/security/data/cve/CVE-2026-53797.md) | Routine | rsync < 3.5.0 Symlink Race Condition Information Disclosure | 4.7 | 0.0014 |  |
| [CVE-2026-53800](https://patchblox.com/security/data/cve/CVE-2026-53800.md) | Routine | rsync < 3.5.0 Symlink Race Condition via --remove-source-files | 4.7 | 0.0014 |  |
| [CVE-2026-43619](https://patchblox.com/security/data/cve/CVE-2026-43619.md) | Routine | Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls | 6.3 | 0.0014 |  |
| [CVE-2026-53799](https://patchblox.com/security/data/cve/CVE-2026-53799.md) | Routine | rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application | 6.3 | 0.0012 |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.