SUSE-SU-2026:3634-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20263634-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3634-1
Upstream
CVE (34)
Related
CVE (34)
Published
2026-08-17T19:03:56Z
Modified
2026-08-18T09:31:01Z
Summary
Security update for rsync
Details

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Micro 5.3
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Micro 5.4
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Micro 5.5
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Micro%205.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Server 15 SP4-LTSS
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Server 15 SP5-LTSS
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
rsync

Package

Name
rsync
Purl
pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-150400.3.34.1

Ecosystem specific 

{
    "binaries":  [
        {
            "rsync":  "3.2.3-150400.3.34.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3634-1.json"