rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout
    implementation that allows attackers to permanently disable connection timeouts by injecting
    MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious
    MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the
    timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely,
    leading to resource exhaustion. (CVE-2026-70462)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1790267010 advisory.

  - rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the     rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory     restrictions by substituting a symlink for a path component after validation but before transfer     processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and
    --log-file through rrsync to read or write files outside the permitted directory subtree. (CVE-2026-53783)

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that     allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the     argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one     slot beyond the allocation boundary, corrupting adjacent heap memory. (CVE-2026-70456)

  - rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt     memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-     link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct     layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
    (CVE-2026-70458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1789749013 advisory.

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape     the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary     when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./     notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain     unauthorized read or write access to files outside the module's subtree. (CVE-2026-53793)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt     memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-     link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct     layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
    (CVE-2026-70458)

  - rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout     implementation that allows attackers to permanently disable connection timeouts by injecting     MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious     MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the     timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely,     leading to resource exhaustion. (CVE-2026-70462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789737518 advisory.

  - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files     outside the intended destination directory tree by crafting relative paths with symlink components in
    --relative mode. The make_path() function follows symlinks pointing outside the destination tree while     creating intermediate directories without verifying that created paths remain within the destination     boundary, enabling arbitrary file writes on the receiver's filesystem. (CVE-2026-53785)

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration     setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap.
    Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file     list and data structures, potentially exhausting available memory and causing a denial of service.
    (CVE-2026-53794)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that     allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the     argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one     slot beyond the allocation boundary, corrupting adjacent heap memory. (CVE-2026-70456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790173668 advisory.

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that     allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the     argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one     slot beyond the allocation boundary, corrupting adjacent heap memory. (CVE-2026-70456)

  - rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt     memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-     link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct     layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
    (CVE-2026-70458)

  - rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout     implementation that allows attackers to permanently disable connection timeouts by injecting     MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious     MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the     timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely,     leading to resource exhaustion. (CVE-2026-70462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789783256 advisory.

  - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files     outside the intended destination directory tree by crafting relative paths with symlink components in
    --relative mode. The make_path() function follows symlinks pointing outside the destination tree while     creating intermediate directories without verifying that created paths remain within the destination     boundary, enabling arbitrary file writes on the receiver's filesystem. (CVE-2026-53785)

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration     setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap.
    Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file     list and data structures, potentially exhausting available memory and causing a denial of service.
    (CVE-2026-53794)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that     allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the     argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one     slot beyond the allocation boundary, corrupting adjacent heap memory. (CVE-2026-70456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789783256 advisory.

  - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files     outside the intended destination directory tree by crafting relative paths with symlink components in
    --relative mode. The make_path() function follows symlinks pointing outside the destination tree while     creating intermediate directories without verifying that created paths remain within the destination     boundary, enabling arbitrary file writes on the receiver's filesystem. (CVE-2026-53785)

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration     setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap.
    Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file     list and data structures, potentially exhausting available memory and causing a denial of service.
    (CVE-2026-53794)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that     allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the     argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one     slot beyond the allocation boundary, corrupting adjacent heap memory. (CVE-2026-70456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6527 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6527-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 28, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : rsync     CVE ID         : CVE-2026-53783 CVE-2026-53784 CVE-2026-53785 CVE-2026-53786                      CVE-2026-53788 CVE-2026-53789 CVE-2026-53790 CVE-2026-53791                      CVE-2026-53792 CVE-2026-53793 CVE-2026-53794 CVE-2026-53795                      CVE-2026-53796 CVE-2026-53797 CVE-2026-53798 CVE-2026-53799                      CVE-2026-53800 CVE-2026-53801 CVE-2026-53802 CVE-2026-53803                      CVE-2026-70452 CVE-2026-70453 CVE-2026-70454 CVE-2026-70455                      CVE-2026-70456 CVE-2026-70457 CVE-2026-70458 CVE-2026-70459                      CVE-2026-70460 CVE-2026-70461 CVE-2026-70462 CVE-2026-70463                      CVE-2026-70464

    Several vulnerabilities were discovered in rsync, a fast, versatile,     remote (and local) file-copying tool, which could result in local     privilege escalation, bypass of intended access restrictions,     information disclosure, denial of service or the execution of arbitrary     code.

    Details can be found at     https://download.samba.org/pub/rsync/NEWS#3.5.0

    For the stable distribution (trixie), these problems have been fixed in     version 3.5.0+ds1-0+deb13u1.

    We recommend that you upgrade your rsync packages.

    For the detailed security status of rsync please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/rsync

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under use chroot = no (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot /./ inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set     (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: auth users ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fee67ad5-a05e-11f1-ad2b-40b034429ecf advisory.

    rsync project reports:
    This release fixes 33 security issues found during a focused audit of rsync's path           handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports               from external researchers -- plus several robustness hardenings. CVE IDs were assigned               by VulnCheck (CNA); the precise introduced in version ranges accompany each advisory,               and many are much narrower than everything before 3.5.0. Every fix ships with a               regression test in the test suite that fails on the unfixed tree.
    support/rrsync (the restricted SSH wrapper):
    Daemon protocol / identity:
    Injection and memory safety:
    Peer-triggerable memory corruption in the daemon protocol:
    Daemon availability and access control:
    Client-side:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d6763b4c84 advisory.

    New version 3.5.0. Includes fixes for following CVEs:
    CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789,     CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795,     CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801,     CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455,     CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461,     CVE-2026-70462, CVE-2026-70463, CVE-2026-70464





Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bfae8723e2 advisory.

    New version 3.5.0. Includes fixes for following CVEs:
    CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789,     CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795,     CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801,     CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455,     CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461,     CVE-2026-70462, CVE-2026-70463, CVE-2026-70464




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3657-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local     privilege       escalation) (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local     privilege       escalation) (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout     implementation that allows attackers to permanently disable connection timeouts by injecting     MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious     MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the     timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely,     leading to resource exhaustion. (CVE-2026-70462)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460411	Echo: rsync: security update to 3.5.0+ds1-1	Tenable Cloud Security	Echo Local Security Checks	Local	high
460411	Echo: rsync: security update to 3.5.0+ds1-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
361674	CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1790267010)	Nessus	CentOS Local Security Checks	Local	critical
361436	CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789749013)	Nessus	CentOS Local Security Checks	Local	critical
360544	AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789737518)	Nessus	Alma Linux Local Security Checks	Local	critical
360018	CentOS Linux 8.5 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790173668)	Nessus	CentOS Local Security Checks	Local	critical
353044	AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789783256)	Nessus	Alma Linux Local Security Checks	Local	critical
352609	Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789783256)	Nessus	Rocky Linux Local Security Checks	Local	critical
351050	Amazon Linux 2023 : rsync, rsync-daemon (ALAS2023-2026-3131)	Nessus	Amazon Linux Local Security Checks	Local	critical
350989	Debian dsa-6527 : rsync - security update	Nessus	Debian Local Security Checks	Local	critical
341163	openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)	Nessus	SuSE Local Security Checks	Local	critical
341069	FreeBSD : net/rsync -- multiple vulnerabilities (fee67ad5-a05e-11f1-ad2b-40b034429ecf)	Nessus	FreeBSD Local Security Checks	Local	critical
341040	Fedora 43 : rsync (2026-d6763b4c84)	Nessus	Fedora Local Security Checks	Local	critical
338831	Fedora 44 : rsync (2026-bfae8723e2)	Nessus	Fedora Local Security Checks	Local	critical
338828	SUSE SLED15 / SLES15 Security Update : rsync (SUSE-SU-2026:3657-1)	Nessus	SuSE Local Security Checks	Local	critical
337988	SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)	Nessus	SuSE Local Security Checks	Local	critical
335052	Linux Distros Unpatched Vulnerability : CVE-2026-70462	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-70462

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high