- CVE-2026-53792: reject a peer-supplied checksum header with a non-zero block count and a zero block length, so a malicious receiver can no longer drive the sender's block matching into an out-of-bounds read - CVE-2026-53796: resolve the non-daemon receiver's destination directory through the ownership-checked symlink walk and fchdir() instead of a plain chdir(), so a parent component raced to a symlink owned by another user can no longer move the receiver outside the intended destination - CVE-2026-70452: fail closed when a "hosts deny" hostname token cannot be resolved, so a DNS lookup failure can no longer silently skip a deny rule and admit the host it was meant to block