net/rsync -- multiple vulnerabilities

2026-08-25 · CVE-2026-53802, CVE-2026-53803, CVE-2026-53785, CVE-2026-53784, CVE-2026-53793, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53783, CVE-2026-53786, CVE-2026-53798, CVE-2026-53788, CVE-2026-53789, CVE-2026-53791, CVE-2026-53790, CVE-2026-53792, CVE-2026-53794, CVE-2026-70461, CVE-2026-70458, CVE-2026-70456, CVE-2026-70457, CVE-2026-70459, CVE-2026-70464, CVE-2026-70455, CVE-2026-70453, CVE-2026-70452, CVE-2026-70463, CVE-2026-70460, CVE-2026-70462, CVE-2026-70454 · VuXML entry

rsync project reports: This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges accompany each advisory, and many are much narrower than "everything before …

Affected versions

• rsync < 3.5.0

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.