Release date:
2026-09-23 14:28:08 UTC
Description:
- CVE-2026-53790: command injection in the daemon pre-/post-xfer exec hooks and RSYNC_CONNECT_PROG
- CVE-2026-70453: denial of service in hash_search() -- unbounded chain walk
- CVE-2026-70456: out-of-bounds write in read_args() -- no slot reserved for the trailing NULL
- CVE-2026-70458: out-of-bounds read of the F_SUM slot in hard_link_check()
- CVE-2026-70462: denial of service via a peer-supplied MSG_IO_TIMEOUT in set_io_timeout()
- CVE-2026-70464: denial of service -- unbounded daemon pre-transfer handshake
Updated packages:
-
rsync-3.1.3-12.el8.tuxcare.els15.x86_64.rpm
sha:a317185f7aab6e88649a681434892d20967c608b6887497a3c67564a53651806
-
rsync-daemon-3.1.3-12.el8.tuxcare.els15.noarch.rpm
sha:35d8221d07f078e0469bd0e55f114b3fe3f7f70e0d451eec3ffccaaca06f56e7
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
