rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674630 advisory.

    - Resolves: RHEL-245337 - Directory escape via TOCTOU (CVE-2026-53783)
    - Resolves: RHEL-244599 - Arbitrary file write (CVE-2026-53785)
    - Resolves: RHEL-246095 - Command injection (CVE-2026-53790)
    - Resolves: RHEL-246065 - Daemon IP spoofing (CVE-2026-53791)
    - Resolves: RHEL-244718 - Local privilege escalation (CVE-2026-53803)
    - Resolves: RHEL-244797 - DoS via algorithmic complexity (CVE-2026-70453)
    - Resolves: RHEL-245247 - DoS via Zstandard compression (CVE-2026-70455)
    - Resolves: RHEL-245188 - Heap out-of-bounds write (CVE-2026-70456)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-674620 advisory.

    [3.2.7-1]
    - Resolves: RHEL-248836 - Rebase rsync to version 3.2.7 in RHEL9

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1850:08 advisory.

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
      * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)
      * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
      * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
      * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
      * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
      * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
      * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
      * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
      * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
      * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
      * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
      * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
      * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
      * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
      * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
      * rsync: rsync: Information disclosure and denial of service via crafted files-from entry     (CVE-2026-70461)
      * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
      * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
      * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)     Bug Fix(es) and Enhancement(s):
      * Rebase rsync to version 3.2.7 in RHEL9 (JIRA:RHEL-248835)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67462 advisory.

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

    * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)

    * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

    * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

    * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

    * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

    * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

    * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

    * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)

    * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

    * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

    * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

    * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

    * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

    * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

    * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

    * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

    * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

    * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

    * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

    Bug Fix(es) and Enhancement(s):

    * Rebase rsync to version 3.2.7 in Rocky Linux9 (JIRA:Rocky Linux-248835)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67462 advisory.

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
      * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)
      * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
      * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
      * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
      * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
      * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
      * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
      * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
      * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
      * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
      * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
      * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
      * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
      * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
      * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
      * rsync: rsync: Information disclosure and denial of service via crafted files-from entry     (CVE-2026-70461)
      * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
      * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
      * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)


    Bug Fix(es) and Enhancement(s):

      * Rebase rsync to version 3.2.7 in AlmaLinux9 (JIRA:AlmaLinux-248835)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67463 advisory.

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
      * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)
      * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
      * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
      * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
      * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
      * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
      * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
      * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
      * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
      * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
      * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
      * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
      * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
      * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
      * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)
      * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
      * rsync: rsync: Information disclosure and denial of service via crafted files-from entry     (CVE-2026-70461)
      * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
      * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
      * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)


    Bug Fix(es) and Enhancement(s):

      * Rebase rsync to version 3.5.0 in AlmaLinux10 (JIRA:AlmaLinux-246094)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67463 advisory.

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

    * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)

    * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

    * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

    * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

    * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

    * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

    * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

    * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)

    * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

    * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

    * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

    * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

    * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

    * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

    * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)

    * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

    * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

    * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

    * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

    * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

    Bug Fix(es) and Enhancement(s):

    * Rebase rsync to version 3.5.0 in Rocky Linux10 (JIRA:Rocky Linux-246094)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67462 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

    * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)

    * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

    * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

    * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

    * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

    * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

    * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

    * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)

    * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

    * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

    * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

    * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

    * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

    * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

    * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

    * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

    * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

    * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

    * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

    Bug Fix(es) and Enhancement(s):

    * Rebase rsync to version 3.2.7 in RHEL9 (JIRA:RHEL-248835)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67463 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)

    * rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions     (CVE-2026-70454)

    * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)

    * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)

    * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)

    * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)

    * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)

    * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)

    * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)

    * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)

    * rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)

    * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)

    * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)

    * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)

    * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)

    * rsync: rsync: Denial of Service via Zstandard compression thread exhaustion (CVE-2026-70455)

    * rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)

    * rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)

    * rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)

    * rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)

    * rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)

    Bug Fix(es) and Enhancement(s):

    * Rebase rsync to version 3.5.0 in RHEL10 (JIRA:RHEL-246094)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under use chroot = no (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot /./ inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set     (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: auth users ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fee67ad5-a05e-11f1-ad2b-40b034429ecf advisory.

    rsync project reports:
    This release fixes 33 security issues found during a focused audit of rsync's path           handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports               from external researchers -- plus several robustness hardenings. CVE IDs were assigned               by VulnCheck (CNA); the precise introduced in version ranges accompany each advisory,               and many are much narrower than everything before 3.5.0. Every fix ships with a               regression test in the test suite that fails on the unfixed tree.
    support/rrsync (the restricted SSH wrapper):
    Daemon protocol / identity:
    Injection and memory safety:
    Peer-triggerable memory corruption in the daemon protocol:
    Daemon availability and access control:
    Client-side:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d6763b4c84 advisory.

    New version 3.5.0. Includes fixes for following CVEs:
    CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789,     CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795,     CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801,     CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455,     CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461,     CVE-2026-70462, CVE-2026-70463, CVE-2026-70464





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bfae8723e2 advisory.

    New version 3.5.0. Includes fixes for following CVEs:
    CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789,     CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795,     CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801,     CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455,     CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461,     CVE-2026-70462, CVE-2026-70463, CVE-2026-70464




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3657-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local     privilege       escalation) (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local     privilege       escalation) (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote     unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by     supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync     daemon module by providing a files-from entry containing both an interior and trailing backslash, causing     the add_implied_include() function to under-count the trailing backslash when sizing the destination     buffer. (CVE-2026-70461)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346424	Oracle Linux 10 : ELSA-2026-67463-0: / rsync (ELSA-2026-674630)	Nessus	Oracle Linux Local Security Checks	Local	critical
346417	Oracle Linux 9 : ELSA-2026-67462-0: / rsync (ELSA-2026-674620)	Nessus	Oracle Linux Local Security Checks	Local	critical
346315	MiracleLinux 9 : rsync-3.2.7-1.el9_8 (AXSA:2026-1850:08)	Nessus	Miracle Linux Local Security Checks	Local	critical
346031	RockyLinux 9 : rsync (RLSA-2026:67462)	Nessus	Rocky Linux Local Security Checks	Local	critical
345944	AlmaLinux 9 : rsync (ALSA-2026:67462)	Nessus	Alma Linux Local Security Checks	Local	critical
345931	AlmaLinux 10 : rsync (ALSA-2026:67463)	Nessus	Alma Linux Local Security Checks	Local	critical
345927	RockyLinux 10 : rsync (RLSA-2026:67463)	Nessus	Rocky Linux Local Security Checks	Local	critical
345726	RHEL 9 : rsync (RHSA-2026:67462)	Nessus	Red Hat Local Security Checks	Local	critical
345724	RHEL 10 : rsync (RHSA-2026:67463)	Nessus	Red Hat Local Security Checks	Local	critical
341163	openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)	Nessus	SuSE Local Security Checks	Local	critical
341069	FreeBSD : net/rsync -- multiple vulnerabilities (fee67ad5-a05e-11f1-ad2b-40b034429ecf)	Nessus	FreeBSD Local Security Checks	Local	critical
341040	Fedora 43 : rsync (2026-d6763b4c84)	Nessus	Fedora Local Security Checks	Local	critical
338831	Fedora 44 : rsync (2026-bfae8723e2)	Nessus	Fedora Local Security Checks	Local	critical
338828	SUSE SLED15 / SLES15 Security Update : rsync (SUSE-SU-2026:3657-1)	Nessus	SuSE Local Security Checks	Local	critical
337988	SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)	Nessus	SuSE Local Security Checks	Local	critical
335049	Linux Distros Unpatched Vulnerability : CVE-2026-70461	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-70461

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high