# rsync.

Every CVE that names rsync among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions](https://agentprime.io/advisories/CVE-2026-119741.md)
  `CVE-2026-119741` · CVE record: RsyncProject rsync · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Denial of service
- [rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure](https://agentprime.io/advisories/CVE-2026-70452.md)
  `CVE-2026-70452` · CVE record: RsyncProject rsync · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control, CWE-636
- [rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()](https://agentprime.io/advisories/CVE-2026-70453.md)
  `CVE-2026-70453` · CVE record: RsyncProject rsync · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service
- [rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode](https://agentprime.io/advisories/CVE-2026-70454.md)
  `CVE-2026-70454` · CVE record: RsyncProject rsync · CVSS 7.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Weak cryptography or TLS
- [rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion](https://agentprime.io/advisories/CVE-2026-70455.md)
  `CVE-2026-70455` · CVE record: RsyncProject rsync · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service
- [rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()](https://agentprime.io/advisories/CVE-2026-70456.md)
  `CVE-2026-70456` · CVE record: RsyncProject rsync · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption
- [rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()](https://agentprime.io/advisories/CVE-2026-70457.md)
  `CVE-2026-70457` · CVE record: RsyncProject rsync · CVSS 8.3 High · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption
- [rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling](https://agentprime.io/advisories/CVE-2026-70458.md)
  `CVE-2026-70458` · CVE record: RsyncProject rsync · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption
- [rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry](https://agentprime.io/advisories/CVE-2026-70459.md)
  `CVE-2026-70459` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption
- [rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink](https://agentprime.io/advisories/CVE-2026-70460.md)
  `CVE-2026-70460` · CVE record: RsyncProject rsync · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry](https://agentprime.io/advisories/CVE-2026-70461.md)
  `CVE-2026-70461` · CVE record: RsyncProject rsync · CVSS 8.8 High · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption
- [rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT](https://agentprime.io/advisories/CVE-2026-70462.md)
  `CVE-2026-70462` · CVE record: RsyncProject rsync · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption, Denial of service
- [rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing](https://agentprime.io/advisories/CVE-2026-70463.md)
  `CVE-2026-70463` · CVE record: RsyncProject rsync · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control
- [rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall](https://agentprime.io/advisories/CVE-2026-70464.md)
  `CVE-2026-70464` · CVE record: RsyncProject rsync · CVSS 8.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service
- [rsync < 3.5.0 Symlink Race Condition Directory Traversal](https://agentprime.io/advisories/CVE-2026-53801.md)
  `CVE-2026-53801` · CVE record: RsyncProject rsync · CVSS 8.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Symlink Race Condition via --remove-source-files](https://agentprime.io/advisories/CVE-2026-53800.md)
  `CVE-2026-53800` · CVE record: RsyncProject rsync · CVSS 5.7 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application](https://agentprime.io/advisories/CVE-2026-53799.md)
  `CVE-2026-53799` · CVE record: RsyncProject rsync · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Symlink Race Condition Information Disclosure](https://agentprime.io/advisories/CVE-2026-53797.md)
  `CVE-2026-53797` · CVE record: RsyncProject rsync · CVSS 5.7 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling](https://agentprime.io/advisories/CVE-2026-53796.md)
  `CVE-2026-53796` · CVE record: RsyncProject rsync · CVSS 5.8 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Race condition
- [rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest](https://agentprime.io/advisories/CVE-2026-53795.md)
  `CVE-2026-53795` · CVE record: RsyncProject rsync · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error](https://agentprime.io/advisories/CVE-2026-53794.md)
  `CVE-2026-53794` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-1284
- [rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode](https://agentprime.io/advisories/CVE-2026-53793.md)
  `CVE-2026-53793` · CVE record: RsyncProject rsync · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum Block](https://agentprime.io/advisories/CVE-2026-53792.md)
  `CVE-2026-53792` · CVE record: RsyncProject rsync · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Memory corruption, CWE-129
- [rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header](https://agentprime.io/advisories/CVE-2026-53791.md)
  `CVE-2026-53791` · CVE record: RsyncProject rsync · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Authentication bypass
- [rsync < 3.5.0 Command Injection via Multiple Code Paths](https://agentprime.io/advisories/CVE-2026-53790.md)
  `CVE-2026-53790` · CVE record: RsyncProject rsync · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Command injection
- [rsync < 3.5.0 Arbitrary File Deletion via Malicious File List](https://agentprime.io/advisories/CVE-2026-53789.md)
  `CVE-2026-53789` · CVE record: RsyncProject rsync · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-807
- [rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping](https://agentprime.io/advisories/CVE-2026-53788.md)
  `CVE-2026-53788` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Other injection
- [rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping](https://agentprime.io/advisories/CVE-2026-53798.md)
  `CVE-2026-53798` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-704
- [rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive](https://agentprime.io/advisories/CVE-2026-53786.md)
  `CVE-2026-53786` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control
- [rsync < 3.5.0 Path Traversal Write Escape via --relative Mode](https://agentprime.io/advisories/CVE-2026-53785.md)
  `CVE-2026-53785` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Path Traversal via Symlink Module Root](https://agentprime.io/advisories/CVE-2026-53784.md)
  `CVE-2026-53784` · CVE record: RsyncProject rsync · CVSS 8.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync](https://agentprime.io/advisories/CVE-2026-53783.md)
  `CVE-2026-53783` · CVE record: RsyncProject rsync · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Command injection
- [rsync < 3.5.0 Symlink Following Arbitrary File Overwrite](https://agentprime.io/advisories/CVE-2026-53803.md)
  `CVE-2026-53803` · CVE record: RsyncProject rsync · CVSS 8.5 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [rsync < 3.5.0 Arbitrary File Read via Symlink Following](https://agentprime.io/advisories/CVE-2026-53802.md)
  `CVE-2026-53802` · CVE record: RsyncProject rsync · CVSS 8.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-61
- [Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-29518.md)
  `CVE-2026-29518` · CVE record: RsyncProject rsync · CVSS 7.3 High · Not analysed yet · Published 20 May 2026 · Tags: Race condition
- [Rsync < 3.4.3 Authorization Bypass via Hostname Resolution](https://agentprime.io/advisories/CVE-2026-43617.md)
  `CVE-2026-43617` · CVE record: RsyncProject rsync · CVSS 6.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-289
- [Rsync < 3.4.3 Integer Overflow Information Disclosure](https://agentprime.io/advisories/CVE-2026-43618.md)
  `CVE-2026-43618` · CVE record: RsyncProject rsync · CVSS 6.1 Medium · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption
- [Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls](https://agentprime.io/advisories/CVE-2026-43619.md)
  `CVE-2026-43619` · CVE record: RsyncProject rsync · CVSS 7.2 High · Not analysed yet · Published 20 May 2026 · Tags: Path traversal, Race condition
- [Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()](https://agentprime.io/advisories/CVE-2026-43620.md)
  `CVE-2026-43620` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption
- [Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy](https://agentprime.io/advisories/CVE-2026-45232.md)
  `CVE-2026-45232` · CVE record: RsyncProject rsync · CVSS 2.1 Low · Not analysed yet · Published 20 May 2026 · Tags: CWE-193
- [Rsync: Out of bounds array access via negative index](https://agentprime.io/advisories/CVE-2025-10158.md)
  `CVE-2025-10158` · CVE record: rsync rsync · CVSS 4.3 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-129
- [Improper certificate validation in rsync](https://agentprime.io/advisories/CVE-2020-14387.md)
  `CVE-2020-14387` · CVE record: rsync · No CVSS score · Not analysed yet · Published 27 May 2021 · Tags: Weak cryptography or TLS

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=rsync>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/rsync/>. Everything for agents: <https://agentprime.io/llms.txt>.