# OPENSUSE-SU-2026:21650-1: rsync security update

OPENSUSE-SU-2026:21650-1, released August 26, 2026, fixes 41 CVEs in rsync (version 3.4.1-160000.6.1). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-21650-1
- Platform: Linux
- Released: Aug 26, 2026
- Priority: Urgent (Closes CVE-2026-53791, rated Critical)
- CVEs: 41, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:21650-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [rsync](https://patchblox.com/security/data/product/linux/rsync.md) | opensuse-leap 16.0 | 3.4.1-160000.6.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53791](https://patchblox.com/security/data/cve/CVE-2026-53791.md) | Urgent | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 |  |
| [CVE-2026-70460](https://patchblox.com/security/data/cve/CVE-2026-70460.md) | Urgent | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 |  |
| [CVE-2026-70452](https://patchblox.com/security/data/cve/CVE-2026-70452.md) | Urgent | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0044 |  |
| [CVE-2026-43618](https://patchblox.com/security/data/cve/CVE-2026-43618.md) | High | Rsync < 3.4.3 Integer Overflow Information Disclosure | 8.1 | 0.0078 |  |
| [CVE-2026-70464](https://patchblox.com/security/data/cve/CVE-2026-70464.md) | High | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 |  |
| [CVE-2026-53790](https://patchblox.com/security/data/cve/CVE-2026-53790.md) | High | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 |  |
| [CVE-2026-70453](https://patchblox.com/security/data/cve/CVE-2026-70453.md) | High | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0059 |  |
| [CVE-2026-70461](https://patchblox.com/security/data/cve/CVE-2026-70461.md) | High | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 |  |
| [CVE-2026-70455](https://patchblox.com/security/data/cve/CVE-2026-70455.md) | High | rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion | 8.2 | 0.0057 |  |
| [CVE-2026-70456](https://patchblox.com/security/data/cve/CVE-2026-70456.md) | High | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0044 |  |
| [CVE-2026-70458](https://patchblox.com/security/data/cve/CVE-2026-70458.md) | High | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0044 |  |
| [CVE-2026-53783](https://patchblox.com/security/data/cve/CVE-2026-53783.md) | High | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0043 |  |
| [CVE-2026-53795](https://patchblox.com/security/data/cve/CVE-2026-53795.md) | High | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 |  |
| [CVE-2026-70457](https://patchblox.com/security/data/cve/CVE-2026-70457.md) | High | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 |  |
| [CVE-2026-53793](https://patchblox.com/security/data/cve/CVE-2026-53793.md) | High | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0037 |  |
| [CVE-2026-70463](https://patchblox.com/security/data/cve/CVE-2026-70463.md) | High | rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing | 8.2 | 0.0036 |  |
| [CVE-2026-53789](https://patchblox.com/security/data/cve/CVE-2026-53789.md) | High | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 |  |
| [CVE-2026-53784](https://patchblox.com/security/data/cve/CVE-2026-53784.md) | High | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 |  |
| [CVE-2026-53802](https://patchblox.com/security/data/cve/CVE-2026-53802.md) | High | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 |  |
| [CVE-2026-53785](https://patchblox.com/security/data/cve/CVE-2026-53785.md) | High | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0024 |  |
| [CVE-2026-53803](https://patchblox.com/security/data/cve/CVE-2026-53803.md) | High | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 |  |
| [CVE-2026-70454](https://patchblox.com/security/data/cve/CVE-2026-70454.md) | High | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 |  |
| [CVE-2026-44508](https://patchblox.com/security/data/cve/CVE-2026-44508.md) | High | rsync: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files | 8.1 | n/a |  |
| [CVE-2026-70459](https://patchblox.com/security/data/cve/CVE-2026-70459.md) | Routine | rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry | 5.3 | 0.0072 |  |
| [CVE-2026-53794](https://patchblox.com/security/data/cve/CVE-2026-53794.md) | Routine | rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error | 5.3 | 0.0057 |  |
| [CVE-2026-43620](https://patchblox.com/security/data/cve/CVE-2026-43620.md) | Routine | Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files() | 6.5 | 0.0043 |  |
| [CVE-2026-53798](https://patchblox.com/security/data/cve/CVE-2026-53798.md) | Routine | rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping | 5.3 | 0.0043 |  |
| [CVE-2026-53786](https://patchblox.com/security/data/cve/CVE-2026-53786.md) | Routine | rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive | 6.5 | 0.0040 |  |
| [CVE-2026-53792](https://patchblox.com/security/data/cve/CVE-2026-53792.md) | Routine | rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block | 6.5 | 0.0035 |  |
| [CVE-2026-53788](https://patchblox.com/security/data/cve/CVE-2026-53788.md) | Routine | rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping | 6.5 | 0.0030 |  |
| [CVE-2026-70462](https://patchblox.com/security/data/cve/CVE-2026-70462.md) | Routine | rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT | 6.5 | 0.0029 |  |
| [CVE-2026-53801](https://patchblox.com/security/data/cve/CVE-2026-53801.md) | Routine | rsync < 3.5.0 Symlink Race Condition Directory Traversal | 5.9 | 0.0029 |  |
| [CVE-2026-43617](https://patchblox.com/security/data/cve/CVE-2026-43617.md) | Routine | Rsync < 3.4.3 Authorization Bypass via Hostname Resolution | 4.8 | 0.0028 |  |
| [CVE-2026-53796](https://patchblox.com/security/data/cve/CVE-2026-53796.md) | Routine | rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling | 6.3 | 0.0015 |  |
| [CVE-2026-53797](https://patchblox.com/security/data/cve/CVE-2026-53797.md) | Routine | rsync < 3.5.0 Symlink Race Condition Information Disclosure | 4.7 | 0.0014 |  |
| [CVE-2026-53800](https://patchblox.com/security/data/cve/CVE-2026-53800.md) | Routine | rsync < 3.5.0 Symlink Race Condition via --remove-source-files | 4.7 | 0.0014 |  |
| [CVE-2026-43619](https://patchblox.com/security/data/cve/CVE-2026-43619.md) | Routine | Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls | 6.3 | 0.0014 |  |
| [CVE-2026-53799](https://patchblox.com/security/data/cve/CVE-2026-53799.md) | Routine | rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application | 6.3 | 0.0012 |  |
| [CVE-2026-44510](https://patchblox.com/security/data/cve/CVE-2026-44510.md) | Routine | rsync: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files | 6.5 | n/a |  |
| [CVE-2026-44509](https://patchblox.com/security/data/cve/CVE-2026-44509.md) | Routine | rsync: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files | 6.3 | n/a |  |
| [CVE-2026-44507](https://patchblox.com/security/data/cve/CVE-2026-44507.md) | Routine | rsync: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files | 4.8 | n/a |  |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.