# SUSE-SU-2026:3657-1: rsync security update

SUSE-SU-2026:3657-1, released August 20, 2026, fixes 33 CVEs in rsync (version 3.2.7-150600.3.24.1). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-3657-1
- Platform: Linux
- Released: Aug 20, 2026
- Priority: Urgent (Closes CVE-2026-53791, rated Critical)
- CVEs: 33, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:3657-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [rsync](https://patchblox.com/security/data/product/linux/rsync.md) | sles 15.6 | 3.2.7-150600.3.24.1 |
| [rsync](https://patchblox.com/security/data/product/linux/rsync.md) | sles 15.7 | 3.2.7-150600.3.24.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-53791](https://patchblox.com/security/data/cve/CVE-2026-53791.md) | Urgent | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 |  |
| [CVE-2026-70460](https://patchblox.com/security/data/cve/CVE-2026-70460.md) | Urgent | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 |  |
| [CVE-2026-70452](https://patchblox.com/security/data/cve/CVE-2026-70452.md) | Urgent | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0044 |  |
| [CVE-2026-70464](https://patchblox.com/security/data/cve/CVE-2026-70464.md) | High | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 |  |
| [CVE-2026-53790](https://patchblox.com/security/data/cve/CVE-2026-53790.md) | High | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 |  |
| [CVE-2026-70453](https://patchblox.com/security/data/cve/CVE-2026-70453.md) | High | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0059 |  |
| [CVE-2026-70461](https://patchblox.com/security/data/cve/CVE-2026-70461.md) | High | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 |  |
| [CVE-2026-70455](https://patchblox.com/security/data/cve/CVE-2026-70455.md) | High | rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion | 8.2 | 0.0057 |  |
| [CVE-2026-70456](https://patchblox.com/security/data/cve/CVE-2026-70456.md) | High | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0044 |  |
| [CVE-2026-70458](https://patchblox.com/security/data/cve/CVE-2026-70458.md) | High | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0044 |  |
| [CVE-2026-53783](https://patchblox.com/security/data/cve/CVE-2026-53783.md) | High | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0043 |  |
| [CVE-2026-53795](https://patchblox.com/security/data/cve/CVE-2026-53795.md) | High | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 |  |
| [CVE-2026-70457](https://patchblox.com/security/data/cve/CVE-2026-70457.md) | High | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 |  |
| [CVE-2026-53793](https://patchblox.com/security/data/cve/CVE-2026-53793.md) | High | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0037 |  |
| [CVE-2026-70463](https://patchblox.com/security/data/cve/CVE-2026-70463.md) | High | rsync: ELSA-2026-67462-0: rsync security, bug fix, and enhancement update (IMPORTANT) | 8.2 | 0.0036 |  |
| [CVE-2026-53789](https://patchblox.com/security/data/cve/CVE-2026-53789.md) | High | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 |  |
| [CVE-2026-53784](https://patchblox.com/security/data/cve/CVE-2026-53784.md) | High | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 |  |
| [CVE-2026-53802](https://patchblox.com/security/data/cve/CVE-2026-53802.md) | High | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 |  |
| [CVE-2026-53785](https://patchblox.com/security/data/cve/CVE-2026-53785.md) | High | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0024 |  |
| [CVE-2026-53803](https://patchblox.com/security/data/cve/CVE-2026-53803.md) | High | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 |  |
| [CVE-2026-70454](https://patchblox.com/security/data/cve/CVE-2026-70454.md) | High | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 |  |
| [CVE-2026-70459](https://patchblox.com/security/data/cve/CVE-2026-70459.md) | Routine | rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry | 5.3 | 0.0072 |  |
| [CVE-2026-53794](https://patchblox.com/security/data/cve/CVE-2026-53794.md) | Routine | rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error | 5.3 | 0.0057 |  |
| [CVE-2026-53798](https://patchblox.com/security/data/cve/CVE-2026-53798.md) | Routine | rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping | 5.3 | 0.0043 |  |
| [CVE-2026-53786](https://patchblox.com/security/data/cve/CVE-2026-53786.md) | Routine | rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive | 6.5 | 0.0040 |  |
| [CVE-2026-53792](https://patchblox.com/security/data/cve/CVE-2026-53792.md) | Routine | rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block | 6.5 | 0.0035 |  |
| [CVE-2026-53788](https://patchblox.com/security/data/cve/CVE-2026-53788.md) | Routine | rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping | 6.5 | 0.0030 |  |
| [CVE-2026-70462](https://patchblox.com/security/data/cve/CVE-2026-70462.md) | Routine | rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT | 6.5 | 0.0029 |  |
| [CVE-2026-53801](https://patchblox.com/security/data/cve/CVE-2026-53801.md) | Routine | rsync < 3.5.0 Symlink Race Condition Directory Traversal | 5.9 | 0.0029 |  |
| [CVE-2026-53796](https://patchblox.com/security/data/cve/CVE-2026-53796.md) | Routine | rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling | 6.3 | 0.0015 |  |
| [CVE-2026-53797](https://patchblox.com/security/data/cve/CVE-2026-53797.md) | Routine | rsync < 3.5.0 Symlink Race Condition Information Disclosure | 4.7 | 0.0014 |  |
| [CVE-2026-53800](https://patchblox.com/security/data/cve/CVE-2026-53800.md) | Routine | rsync < 3.5.0 Symlink Race Condition via --remove-source-files | 4.7 | 0.0014 |  |
| [CVE-2026-53799](https://patchblox.com/security/data/cve/CVE-2026-53799.md) | Routine | rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application | 6.3 | 0.0012 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.