{"id":"CLSA-2026-1790267010","summary":"rsync: Fix of 7 CVEs","details":"- CVE-2026-53783: rrsync restricted-directory escape through a symlinked or\n  raced path component, --copy-unsafe-links, -D or a symlinked log file;\n  partial, the dir-merge rule escape needs --confine-root (3.5.0)\n- CVE-2026-53790: the daemon's pre-xfer/post-xfer exec hooks and RSYNC_CONNECT_PROG\n  expanded %RSYNC_*%/%H into a shell command without escaping them\n- CVE-2026-70453: unbounded hash_search() chain walk let a crafted run of equal weak\n  checksums pin the sender at 100% CPU; the per-offset walk is now bounded\n- CVE-2026-70456: heap out-of-bounds write in read_args() when the peer's argument count\n  lands exactly on the argv allocation; room for the trailing NULL is reserved\n- CVE-2026-70458: out-of-bounds write from a file entry marked FLAG_HLINKED accepted while\n  hard-link preservation was inactive; the flag is now gated and excludes dirs\n- CVE-2026-70462: a peer-supplied MSG_IO_TIMEOUT could disable or overflow the client's own\n  I/O timeout; non-positive values are ignored and the value is capped\n- CVE-2026-70464: the pre-transfer daemon handshake ran with no I/O timeout, so an\n  unauthenticated peer could hold every max-connections slot indefinitely\n- safe_arg() left an uninitialized heap byte in remote-shell filename args","modified":"2026-10-26T09:30:54.910717183Z","published":"2026-09-24T16:23:45Z","upstream":["CVE-2026-53783","CVE-2026-53790","CVE-2026-70453","CVE-2026-70456","CVE-2026-70458","CVE-2026-70462","CVE-2026-70464"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1790267010.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53783"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70462"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464"}],"affected":[{"package":{"name":"rsync","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/rsync?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1790267010.json"}},{"package":{"name":"rsync-daemon","ecosystem":"TuxCare:CentOS-Stream:8","purl":"pkg:rpm/tuxcare/rsync-daemon?distro=centos-stream-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els11"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos-stream8els/CLSA-2026-1790267010.json"}}],"schema_version":"1.9.0"}