- CVE-2026-53788: reject control characters in a peer-supplied name before it is written into the daemon name-converter line protocol, closing a request-injection route - CVE-2026-53792: reject a checksum header with a non-zero block count and a zero block length, which drove the sender's rolling-match arithmetic negative - CVE-2026-70454: require a CA certificate for the rsync-ssl stunnel and gnutls backends and bind the server certificate to the requested hostname - CVE-2026-70464: bound the pre-transfer daemon handshake with a deadline, so unauthenticated peers can no longer hold connection slots open past max connections