{"schemaVersion":3,"id":"SUSE-SU-2026:23254-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for rsync\n\nThis update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege\n  escalation) (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).","dates":{"published":"2026-08-24T14:41:03.000Z","modified":"2026-08-31T18:23:08.005Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"rsync&distro=SUSE Linux Micro 6.1","name":"rsync","label":"rsync&distro=SUSE Linux Micro 6.1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rsync&distro=SUSE Linux Micro 6.1","purlType":"rpm","versions":[{"text":"< 3.3.0-slfo.1.1_7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.0-slfo.1.1_7.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623254-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202623254-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1269039","label":"bugzilla.suse.com/1269039","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269040","label":"bugzilla.suse.com/1269040","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269041","label":"bugzilla.suse.com/1269041","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269042","label":"bugzilla.suse.com/1269042","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269043","label":"bugzilla.suse.com/1269043","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269044","label":"bugzilla.suse.com/1269044","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269045","label":"bugzilla.suse.com/1269045","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269046","label":"bugzilla.suse.com/1269046","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269047","label":"bugzilla.suse.com/1269047","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269048","label":"bugzilla.suse.com/1269048","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269049","label":"bugzilla.suse.com/1269049","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269050","label":"bugzilla.suse.com/1269050","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269051","label":"bugzilla.suse.com/1269051","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269052","label":"bugzilla.suse.com/1269052","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269053","label":"bugzilla.suse.com/1269053","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269054","label":"bugzilla.suse.com/1269054","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269055","label":"bugzilla.suse.com/1269055","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269056","label":"bugzilla.suse.com/1269056","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269057","label":"bugzilla.suse.com/1269057","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269058","label":"bugzilla.suse.com/1269058","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1269060","label":"bugzilla.suse.com/1269060","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273429","label":"bugzilla.suse.com/1273429","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273430","label":"bugzilla.suse.com/1273430","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273431","label":"bugzilla.suse.com/1273431","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273432","label":"bugzilla.suse.com/1273432","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273433","label":"bugzilla.suse.com/1273433","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273434","label":"bugzilla.suse.com/1273434","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273435","label":"bugzilla.suse.com/1273435","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273436","label":"bugzilla.suse.com/1273436","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273437","label":"bugzilla.suse.com/1273437","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273438","label":"bugzilla.suse.com/1273438","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273439","label":"bugzilla.suse.com/1273439","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273440","label":"bugzilla.suse.com/1273440","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1273441","label":"bugzilla.suse.com/1273441","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53783","label":"www.suse.com/security/cve/CVE-2026-53783","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53784","label":"www.suse.com/security/cve/CVE-2026-53784","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53785","label":"www.suse.com/security/cve/CVE-2026-53785","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53786","label":"www.suse.com/security/cve/CVE-2026-53786","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53788","label":"www.suse.com/security/cve/CVE-2026-53788","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53789","label":"www.suse.com/security/cve/CVE-2026-53789","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53790","label":"www.suse.com/security/cve/CVE-2026-53790","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53791","label":"www.suse.com/security/cve/CVE-2026-53791","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53792","label":"www.suse.com/security/cve/CVE-2026-53792","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53793","label":"www.suse.com/security/cve/CVE-2026-53793","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53794","label":"www.suse.com/security/cve/CVE-2026-53794","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53795","label":"www.suse.com/security/cve/CVE-2026-53795","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53796","label":"www.suse.com/security/cve/CVE-2026-53796","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53797","label":"www.suse.com/security/cve/CVE-2026-53797","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53798","label":"www.suse.com/security/cve/CVE-2026-53798","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53799","label":"www.suse.com/security/cve/CVE-2026-53799","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53800","label":"www.suse.com/security/cve/CVE-2026-53800","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53801","label":"www.suse.com/security/cve/CVE-2026-53801","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53802","label":"www.suse.com/security/cve/CVE-2026-53802","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53803","label":"www.suse.com/security/cve/CVE-2026-53803","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70452","label":"www.suse.com/security/cve/CVE-2026-70452","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70453","label":"www.suse.com/security/cve/CVE-2026-70453","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70454","label":"www.suse.com/security/cve/CVE-2026-70454","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70455","label":"www.suse.com/security/cve/CVE-2026-70455","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70456","label":"www.suse.com/security/cve/CVE-2026-70456","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70457","label":"www.suse.com/security/cve/CVE-2026-70457","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70458","label":"www.suse.com/security/cve/CVE-2026-70458","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70459","label":"www.suse.com/security/cve/CVE-2026-70459","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70460","label":"www.suse.com/security/cve/CVE-2026-70460","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70461","label":"www.suse.com/security/cve/CVE-2026-70461","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70462","label":"www.suse.com/security/cve/CVE-2026-70462","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70463","label":"www.suse.com/security/cve/CVE-2026-70463","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70464","label":"www.suse.com/security/cve/CVE-2026-70464","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-53783","CVE-2026-53784","CVE-2026-53785","CVE-2026-53786","CVE-2026-53788","CVE-2026-53789","CVE-2026-53790","CVE-2026-53791","CVE-2026-53792","CVE-2026-53793","CVE-2026-53794","CVE-2026-53795","CVE-2026-53796","CVE-2026-53797","CVE-2026-53798","CVE-2026-53799","CVE-2026-53800","CVE-2026-53801","CVE-2026-53802","CVE-2026-53803","CVE-2026-70452","CVE-2026-70453","CVE-2026-70454","CVE-2026-70455","CVE-2026-70456","CVE-2026-70457","CVE-2026-70458","CVE-2026-70459","CVE-2026-70460","CVE-2026-70461","CVE-2026-70462","CVE-2026-70463","CVE-2026-70464"],"downstream":[],"duplicates":[],"related":["CVE-2026-53783","CVE-2026-53784","CVE-2026-53785","CVE-2026-53786","CVE-2026-53788","CVE-2026-53789","CVE-2026-53790","CVE-2026-53791","CVE-2026-53792","CVE-2026-53793","CVE-2026-53794","CVE-2026-53795","CVE-2026-53796","CVE-2026-53797","CVE-2026-53798","CVE-2026-53799","CVE-2026-53800","CVE-2026-53801","CVE-2026-53802","CVE-2026-53803","CVE-2026-70452","CVE-2026-70453","CVE-2026-70454","CVE-2026-70455","CVE-2026-70456","CVE-2026-70457","CVE-2026-70458","CVE-2026-70459","CVE-2026-70460","CVE-2026-70461","CVE-2026-70462","CVE-2026-70463","CVE-2026-70464"]},"timeline":[{"kind":"published","date":"2026-08-24T14:41:03.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-31T18:23:08.005Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T13:17:09.125Z","stale":false,"partial":false}}