Linux · Amazon Linux · Security advisory · September 28, 2026

ALAS2023-2026-3131: Security update for 4 packages

ALAS2023-2026-3131, released September 28, 2026, fixes 37 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
37
3 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0072
54th percentile

Priority of the 37 CVEs

Patch now 0 Urgent 3 High 18 Routine 16

Fixed package versions

ProductReleaseFixed in
rsyncamzn 20233.5.1-1.amzn2023.0.1
rsync-daemonamzn 20233.5.1-1.amzn2023.0.1
rsync-debuginfoamzn 20233.5.1-1.amzn2023.0.1
rsync-debugsourceamzn 20233.5.1-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header9.1 0.0050 None reported
Urgent CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink8.2 0.0045 None reported
Urgent CVE-2026-70452 rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure8.2 0.0044 None reported
High CVE-2026-70464 rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall8.2 0.0064 None reported
High CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths8.2 0.0063 None reported
High CVE-2026-70453 rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()8.2 0.0059 None reported
High CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry8.2 0.0057 None reported
High CVE-2026-70456 rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()8.2 0.0044 None reported
High CVE-2026-70458 rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling8.2 0.0044 None reported
High CVE-2026-53783 rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync8.2 0.0043 None reported
High CVE-2026-53795 rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest8.2 0.0040 None reported
High CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()8.2 0.0038 None reported
High CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode8.2 0.0037 None reported
High CVE-2026-70463 rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing8.2 0.0036 None reported
High CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List8.2 0.0036 None reported
High CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root8.2 0.0024 None reported
High CVE-2026-53802 rsync < 3.5.0 Arbitrary File Read via Symlink Following8.2 0.0024 None reported
High CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode8.2 0.0024 None reported
High CVE-2026-53803 rsync < 3.5.0 Symlink Following Arbitrary File Overwrite8.2 0.0023 None reported
High CVE-2026-70454 rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode8.2 0.0019 None reported
High CVE-2026-29518 Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write8.1 0.0015 None reported
Routine CVE-2026-70459 rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry5.3 0.0072 None reported
Routine CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error5.3 0.0057 None reported
Routine CVE-2026-43620 Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()6.5 0.0043 None reported
Routine CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping5.3 0.0043 None reported
Showing 1 to 25 of 37 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.