ALAS2023-2026-3131: CVEs fixed (Amazon Linux)

ALAS2023-2026-3131 fixes 24 tracked CVEs. Affected systems and fixed versions.

• CVE-2026-53791 CRITICAL 9.1 UPGRADE rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote att
• CVE-2026-53790 HIGH 8.1 rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to ex
• CVE-2026-70461 HIGH 8.2 UPGRADE rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated
• CVE-2026-70460 HIGH 8.1 rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the
• CVE-2026-70464 HIGH 7.5 rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote
• CVE-2026-70453 HIGH 7.5 rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows
• CVE-2026-70456 HIGH 8.2 rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows
• CVE-2026-70458 HIGH 8.2 rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory
• CVE-2026-70452 HIGH 7.4 rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circu
• CVE-2026-53795 HIGH 8.1 UPGRADE rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside
• CVE-2026-53793 HIGH 7.4 rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the i
• CVE-2026-70459 MEDIUM 5.3 UPGRADE rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that al
• CVE-2026-53783 HIGH 8.1 rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync
• CVE-2026-53786 MEDIUM 6.5 UPGRADE rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override m
• CVE-2026-70463 HIGH 8.1 UPGRADE rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing
• CVE-2026-70454 HIGH 8.0 rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate
• CVE-2026-70457 MEDIUM 6.5 UPGRADE rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprint
• CVE-2026-53794 MEDIUM 5.3 rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration settin
• CVE-2026-53798 MEDIUM 5.3 UPGRADE rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mappi
• CVE-2026-53788 MEDIUM 6.5 rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface
• CVE-2026-70462 MEDIUM 6.5 rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation th
• CVE-2026-53801 MEDIUM 5.9 UPGRADE rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic th
• CVE-2026-53803 HIGH 7.8 UPGRADE rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitra
• CVE-2026-53789 MEDIUM 6.5 UPGRADE rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand t

Applies to

• Amazon Linux 2023

← Back to latest CVEs