Linux · 
Rocky Linux · Security advisory · September 15, 2026
Rocky Linux · Security advisory · September 15, 2026RLSA-2026:67462: rsync security update
RLSA-2026:67462, released September 15, 2026, fixes 20 CVEs in rsync (version 0:3.2.7-1.el9_8). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
20
3 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0064
50th percentile
Priority of the 20 CVEs
Patch now 0
Urgent 3
High 17
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| rsync | rocky 9 | 0:3.2.7-1.el9_8 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-53791 | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 | None reported |
| Urgent | CVE-2026-70460 | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 | None reported |
| Urgent | CVE-2026-70452 | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0044 | None reported |
| High | CVE-2026-70464 | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 | None reported |
| High | CVE-2026-53790 | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 | None reported |
| High | CVE-2026-70453 | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0059 | None reported |
| High | CVE-2026-70461 | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 | None reported |
| High | CVE-2026-70456 | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0044 | None reported |
| High | CVE-2026-70458 | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0044 | None reported |
| High | CVE-2026-53783 | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0043 | None reported |
| High | CVE-2026-53795 | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 | None reported |
| High | CVE-2026-70457 | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 | None reported |
| High | CVE-2026-53793 | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0037 | None reported |
| High | CVE-2026-70463 | rsync: rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing | 8.2 | 0.0036 | None reported |
| High | CVE-2026-53789 | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 | None reported |
| High | CVE-2026-53784 | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 | None reported |
| High | CVE-2026-53802 | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 | None reported |
| High | CVE-2026-53785 | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0024 | None reported |
| High | CVE-2026-53803 | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 | None reported |
| High | CVE-2026-70454 | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 | None reported |
Showing 1 to 20 of 20
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.