# RLSA-2026:67462: rsync security update

RLSA-2026:67462, released September 15, 2026, fixes 20 CVEs in rsync (version 0:3.2.7-1.el9_8). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/rlsa-2026-67462
- Platform: Linux
- Released: Sep 15, 2026
- Priority: Urgent (Closes CVE-2026-53791, rated Critical)
- CVEs: 20, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://errata.rockylinux.org/RLSA-2026:67462

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [rsync](https://patchblox.com/security/data/product/linux/rsync.md) | rocky 9 | 0:3.2.7-1.el9_8 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53791](https://patchblox.com/security/data/cve/CVE-2026-53791.md) | Urgent | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 |  |
| [CVE-2026-70460](https://patchblox.com/security/data/cve/CVE-2026-70460.md) | Urgent | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 |  |
| [CVE-2026-70452](https://patchblox.com/security/data/cve/CVE-2026-70452.md) | Urgent | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0044 |  |
| [CVE-2026-70464](https://patchblox.com/security/data/cve/CVE-2026-70464.md) | High | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 |  |
| [CVE-2026-53790](https://patchblox.com/security/data/cve/CVE-2026-53790.md) | High | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 |  |
| [CVE-2026-70453](https://patchblox.com/security/data/cve/CVE-2026-70453.md) | High | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0059 |  |
| [CVE-2026-70461](https://patchblox.com/security/data/cve/CVE-2026-70461.md) | High | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 |  |
| [CVE-2026-70456](https://patchblox.com/security/data/cve/CVE-2026-70456.md) | High | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0044 |  |
| [CVE-2026-70458](https://patchblox.com/security/data/cve/CVE-2026-70458.md) | High | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0044 |  |
| [CVE-2026-53783](https://patchblox.com/security/data/cve/CVE-2026-53783.md) | High | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0043 |  |
| [CVE-2026-53795](https://patchblox.com/security/data/cve/CVE-2026-53795.md) | High | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 |  |
| [CVE-2026-70457](https://patchblox.com/security/data/cve/CVE-2026-70457.md) | High | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 |  |
| [CVE-2026-53793](https://patchblox.com/security/data/cve/CVE-2026-53793.md) | High | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0037 |  |
| [CVE-2026-70463](https://patchblox.com/security/data/cve/CVE-2026-70463.md) | High | rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing | 8.2 | 0.0036 |  |
| [CVE-2026-53789](https://patchblox.com/security/data/cve/CVE-2026-53789.md) | High | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 |  |
| [CVE-2026-53784](https://patchblox.com/security/data/cve/CVE-2026-53784.md) | High | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 |  |
| [CVE-2026-53802](https://patchblox.com/security/data/cve/CVE-2026-53802.md) | High | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 |  |
| [CVE-2026-53785](https://patchblox.com/security/data/cve/CVE-2026-53785.md) | High | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0024 |  |
| [CVE-2026-53803](https://patchblox.com/security/data/cve/CVE-2026-53803.md) | High | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 |  |
| [CVE-2026-70454](https://patchblox.com/security/data/cve/CVE-2026-70454.md) | High | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 |  |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.