# cve.now: Rsyncproject

The newest entries naming Rsyncproject as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119741](https://cve.now/CVE-2026-119741.md): rsync \< 3.5.2 Denial of Service via hash\_search() Checksum Collisions (CVSS 8.7)
- [CVE-2026-70452](https://cve.now/CVE-2026-70452.md): rsync 3.1.0 \< 3.5.0 Access Control Bypass via DNS Resolution Failure (CVSS 9.1)
- [CVE-2026-70453](https://cve.now/CVE-2026-70453.md): rsync \< 3.5.0 Algorithmic Complexity DoS via hash\_search() (CVSS 8.7)
- [CVE-2026-70454](https://cve.now/CVE-2026-70454.md): rsync \< 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode (CVSS 7.6)
- [CVE-2026-70455](https://cve.now/CVE-2026-70455.md): rsync 3.4.2 \< 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion (CVSS 8.7)
- [CVE-2026-70456](https://cve.now/CVE-2026-70456.md): rsync 3.0.1 \< 3.5.0 Heap Out-of-Bounds Write via read\_args() (CVSS 8.8)
- [CVE-2026-70457](https://cve.now/CVE-2026-70457.md): rsync 3.2.3 \< 3.5.0 Out-of-Bounds Write via parse\_size\_arg() (CVSS 8.3)
- [CVE-2026-70458](https://cve.now/CVE-2026-70458.md): rsync 3.0.0 \< 3.5.0 Out-of-Bounds Write via FLAG\_HLINKED Handling (CVSS 8.8)
- [CVE-2026-70459](https://cve.now/CVE-2026-70459.md): rsync 3.0.0 \< 3.5.0 Daemon Crash via Malformed File List Entry (CVSS 6.9)
- [CVE-2026-70460](https://cve.now/CVE-2026-70460.md): rsync 2.3.3 \< 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVSS 9.2)
- [CVE-2026-70461](https://cve.now/CVE-2026-70461.md): rsync 3.2.5 \< 3.5.0 Heap Out-of-Bounds Write via files-from Entry (CVSS 8.8)
- [CVE-2026-70462](https://cve.now/CVE-2026-70462.md): rsync 3.1.0 \< 3.5.0 Signed Integer Overflow via MSG\_IO\_TIMEOUT (CVSS 7.1)
- [CVE-2026-70463](https://cve.now/CVE-2026-70463.md): rsync 3.1.0 \< 3.5.0 Authorization Bypass via auth users Directive Parsing (CVSS 8.6)
- [CVE-2026-70464](https://cve.now/CVE-2026-70464.md): rsync 2.0.0 \< 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall (CVSS 8.7)
- [CVE-2026-53801](https://cve.now/CVE-2026-53801.md): rsync \< 3.5.0 Symlink Race Condition Directory Traversal (CVSS 8.2)
- [CVE-2026-53800](https://cve.now/CVE-2026-53800.md): rsync \< 3.5.0 Symlink Race Condition via --remove-source-files (CVSS 5.7)
- [CVE-2026-53799](https://cve.now/CVE-2026-53799.md): rsync \< 3.5.0 Symlink Race Condition via ACL/xattr Application (CVSS 7.2)
- [CVE-2026-53797](https://cve.now/CVE-2026-53797.md): rsync \< 3.5.0 Symlink Race Condition Information Disclosure (CVSS 5.7)
- [CVE-2026-53796](https://cve.now/CVE-2026-53796.md): rsync \< 3.5.0 TOCTOU Race Condition via Destination Directory Handling (CVSS 5.8)
- [CVE-2026-53795](https://cve.now/CVE-2026-53795.md): rsync \< 3.5.0 Arbitrary File Write via --temp-dir/--link-dest (CVSS 7.2)
- [CVE-2026-53794](https://cve.now/CVE-2026-53794.md): rsync \< 3.5.0 Denial of Service via --max-alloc=0 Logic Error (CVSS 6.9)
- [CVE-2026-53793](https://cve.now/CVE-2026-53793.md): rsync \< 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVSS 9.1)
- [CVE-2026-53792](https://cve.now/CVE-2026-53792.md): rsync \< 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block (CVSS 7.1)
- [CVE-2026-53791](https://cve.now/CVE-2026-53791.md): rsync \< 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVSS 9.1)
- [CVE-2026-53790](https://cve.now/CVE-2026-53790.md): rsync \< 3.5.0 Command Injection via Multiple Code Paths (CVSS 9.2)
- [CVE-2026-53789](https://cve.now/CVE-2026-53789.md): rsync \< 3.5.0 Arbitrary File Deletion via Malicious File List (CVSS 7.1)
- [CVE-2026-53788](https://cve.now/CVE-2026-53788.md): rsync \< 3.5.0 Newline Injection via name-converter uid/gid mapping (CVSS 6.9)
- [CVE-2026-53798](https://cve.now/CVE-2026-53798.md): rsync \< 3.5.0 Privilege Confusion via name-converter uid/gid mapping (CVSS 6.9)
- [CVE-2026-53786](https://cve.now/CVE-2026-53786.md): rsync \< 3.5.0 Filter Rule Bypass via --filter Merge Directive (CVSS 6.9)
- [CVE-2026-53785](https://cve.now/CVE-2026-53785.md): rsync \< 3.5.0 Path Traversal Write Escape via --relative Mode (CVSS 6.9)
- [CVE-2026-53784](https://cve.now/CVE-2026-53784.md): rsync \< 3.5.0 Path Traversal via Symlink Module Root (CVSS 8.4)
- [CVE-2026-53783](https://cve.now/CVE-2026-53783.md): rsync \< 3.5.0 TOCTOU Race Condition Directory Escape via rrsync (CVSS 8.6)
- [CVE-2026-53803](https://cve.now/CVE-2026-53803.md): rsync \< 3.5.0 Symlink Following Arbitrary File Overwrite (CVSS 8.5)
- [CVE-2026-53802](https://cve.now/CVE-2026-53802.md): rsync \< 3.5.0 Arbitrary File Read via Symlink Following (CVSS 8.4)
- [CVE-2026-29518](https://cve.now/CVE-2026-29518.md): Rsync \< 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write (CVSS 7.3)
- [CVE-2026-43617](https://cve.now/CVE-2026-43617.md): Rsync \< 3.4.3 Authorization Bypass via Hostname Resolution (CVSS 6.3)
- [CVE-2026-43618](https://cve.now/CVE-2026-43618.md): Rsync \< 3.4.3 Integer Overflow Information Disclosure (CVSS 6.1)
- [CVE-2026-43619](https://cve.now/CVE-2026-43619.md): Rsync \< 3.4.3 Symlink Race Condition via Path-Based Syscalls (CVSS 7.2)
- [CVE-2026-43620](https://cve.now/CVE-2026-43620.md): Rsync \< 3.4.3 Out-of-Bounds Array Read via recv\_files() (CVSS 6.9)
- [CVE-2026-45232](https://cve.now/CVE-2026-45232.md): Rsync \< 3.4.3 Off-by-One Stack Write via HTTP Proxy (CVSS 2.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/rsyncproject
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.