The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790173668 advisory.

  - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers     to execute arbitrary commands by supplying malicious input through several code paths, including the     RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command     newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-     supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the     rsync process or the invoking user. (CVE-2026-53790)

  - rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that     allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A     sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU     resources with a modest number of crafted entries, causing a sustained denial of service. (CVE-2026-70453)

  - rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that     allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the     argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one     slot beyond the allocation boundary, corrupting adjacent heap memory. (CVE-2026-70456)

  - rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt     memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-     link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct     layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.
    (CVE-2026-70458)

  - rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout     implementation that allows attackers to permanently disable connection timeouts by injecting     MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious     MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the     timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely,     leading to resource exhaustion. (CVE-2026-70462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 8.5 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790173668)

critical Nessus Plugin ID 360018

Version 1.2