Linux · SUSE Linux Enterprise · Security advisory · August 20, 2026
SUSE-SU-2026:3657-1: rsync security update
SUSE-SU-2026:3657-1, released August 20, 2026, fixes 33 CVEs in rsync (version 3.2.7-150600.3.24.1). None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
33
3 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0072
54th percentile
Priority of the 33 CVEs
Patch now 0
Urgent 3
High 18
Routine 12
Fixed package versions
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-53791 | rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header | 9.1 | 0.0050 | None reported |
| Urgent | CVE-2026-70460 | rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink | 8.2 | 0.0045 | None reported |
| Urgent | CVE-2026-70452 | rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure | 8.2 | 0.0044 | None reported |
| High | CVE-2026-70464 | rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall | 8.2 | 0.0064 | None reported |
| High | CVE-2026-53790 | rsync < 3.5.0 Command Injection via Multiple Code Paths | 8.2 | 0.0063 | None reported |
| High | CVE-2026-70453 | rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() | 8.2 | 0.0059 | None reported |
| High | CVE-2026-70461 | rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry | 8.2 | 0.0057 | None reported |
| High | CVE-2026-70455 | rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion | 8.2 | 0.0057 | None reported |
| High | CVE-2026-70456 | rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() | 8.2 | 0.0044 | None reported |
| High | CVE-2026-70458 | rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling | 8.2 | 0.0044 | None reported |
| High | CVE-2026-53783 | rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync | 8.2 | 0.0043 | None reported |
| High | CVE-2026-53795 | rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest | 8.2 | 0.0040 | None reported |
| High | CVE-2026-70457 | rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() | 8.2 | 0.0038 | None reported |
| High | CVE-2026-53793 | rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode | 8.2 | 0.0037 | None reported |
| High | CVE-2026-70463 | rsync: ELSA-2026-67462-0: rsync security, bug fix, and enhancement update (IMPORTANT) | 8.2 | 0.0036 | None reported |
| High | CVE-2026-53789 | rsync < 3.5.0 Arbitrary File Deletion via Malicious File List | 8.2 | 0.0036 | None reported |
| High | CVE-2026-53784 | rsync < 3.5.0 Path Traversal via Symlink Module Root | 8.2 | 0.0024 | None reported |
| High | CVE-2026-53802 | rsync < 3.5.0 Arbitrary File Read via Symlink Following | 8.2 | 0.0024 | None reported |
| High | CVE-2026-53785 | rsync < 3.5.0 Path Traversal Write Escape via --relative Mode | 8.2 | 0.0024 | None reported |
| High | CVE-2026-53803 | rsync < 3.5.0 Symlink Following Arbitrary File Overwrite | 8.2 | 0.0023 | None reported |
| High | CVE-2026-70454 | rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode | 8.2 | 0.0019 | None reported |
| Routine | CVE-2026-70459 | rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry | 5.3 | 0.0072 | None reported |
| Routine | CVE-2026-53794 | rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error | 5.3 | 0.0057 | None reported |
| Routine | CVE-2026-53798 | rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping | 5.3 | 0.0043 | None reported |
| Routine | CVE-2026-53786 | rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive | 6.5 | 0.0040 | None reported |
Showing 1 to 25 of 33
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.