Linux · openSUSE Leap · Security advisory · August 26, 2026

OPENSUSE-SU-2026:21650-1: rsync security update

OPENSUSE-SU-2026:21650-1, released August 26, 2026, fixes 41 CVEs in rsync (version 3.4.1-160000.6.1). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
41
3 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0078
56th percentile

Priority of the 41 CVEs

Patch now 0 Urgent 3 High 20 Routine 18

Fixed package versions

ProductReleaseFixed in
rsyncopensuse-leap 16.03.4.1-160000.6.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header9.1 0.0050 None reported
Urgent CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink8.2 0.0045 None reported
Urgent CVE-2026-70452 rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure8.2 0.0044 None reported
High CVE-2026-43618 Rsync < 3.4.3 Integer Overflow Information Disclosure8.1 0.0078 None reported
High CVE-2026-70464 rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall8.2 0.0064 None reported
High CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths8.2 0.0063 None reported
High CVE-2026-70453 rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()8.2 0.0059 None reported
High CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry8.2 0.0057 None reported
High CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion8.2 0.0057 None reported
High CVE-2026-70456 rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()8.2 0.0044 None reported
High CVE-2026-70458 rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling8.2 0.0044 None reported
High CVE-2026-53783 rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync8.2 0.0043 None reported
High CVE-2026-53795 rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest8.2 0.0040 None reported
High CVE-2026-70457 rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()8.2 0.0038 None reported
High CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode8.2 0.0037 None reported
High CVE-2026-70463 rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing8.2 0.0036 None reported
High CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List8.2 0.0036 None reported
High CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root8.2 0.0024 None reported
High CVE-2026-53802 rsync < 3.5.0 Arbitrary File Read via Symlink Following8.2 0.0024 None reported
High CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode8.2 0.0024 None reported
High CVE-2026-53803 rsync < 3.5.0 Symlink Following Arbitrary File Overwrite8.2 0.0023 None reported
High CVE-2026-70454 rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode8.2 0.0019 None reported
High CVE-2026-44508 rsync: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files8.1 n/a None reported
Routine CVE-2026-70459 rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry5.3 0.0072 None reported
Routine CVE-2026-53794 rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error5.3 0.0057 None reported
Showing 1 to 25 of 41 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.