PatchTheCEVrsync vulnerabilities and fixes
Recent CVEs affecting rsync, with upgrade or downgrade steps. 17 tracked.
rsync has 17 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-08-13. Highest priority: CVE-2026-53791 (score 47/100).
- CVE-2026-53791 CRITICAL 9.1 UPGRADE rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote att
- CVE-2026-70461 HIGH 8.2 UPGRADE rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated
- CVE-2026-70455 HIGH 7.5 UPGRADE rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust sys
- CVE-2026-53795 HIGH 8.1 UPGRADE rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside
- CVE-2026-70459 MEDIUM 5.3 UPGRADE rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that al
- CVE-2026-53786 MEDIUM 6.5 UPGRADE rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override m
- CVE-2026-70463 HIGH 8.1 UPGRADE rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing
- CVE-2026-70457 MEDIUM 6.5 UPGRADE rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprint
- CVE-2026-53798 MEDIUM 5.3 UPGRADE rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mappi
- CVE-2026-53801 MEDIUM 5.9 UPGRADE rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic th
- CVE-2026-53803 HIGH 7.8 UPGRADE rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitra
- CVE-2026-53789 MEDIUM 6.5 UPGRADE rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand t
- CVE-2026-53784 HIGH 7.1 UPGRADE rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside
- CVE-2026-53802 HIGH 7.1 UPGRADE rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessibl
- CVE-2026-53799 MEDIUM 6.3 UPGRADE rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync
- CVE-2026-53797 MEDIUM 4.7 UPGRADE rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that
- CVE-2026-53800 MEDIUM 4.7 UPGRADE rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that a
FAQ
How do I fix rsync vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is rsync being exploited right now?
None of the tracked rsync CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which rsync CVE should I patch first?
CVE-2026-53791 currently ranks highest (47/100): rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote att.