Critical Security Advisory: rsync Package Vulnerability and Update
Summary
RHSA-2026:74095: Red Hat Security Advisory: rsync security, bug fix, and enhancement update. Affects rsync versions < 0:3.1.3-28.el8_10. Fixed in 0:3.1.3-28.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync package is a widely used utility for efficiently transferring and synchronizing files across computer systems. It is known for its speed and flexibility, allowing users to perform incremental backups and mirror data. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package, particularly in Red Hat Enterprise Linux 8.
Vulnerability Detail
The vulnerabilities identified in the rsync package (CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53789, CVE-2026-53790, CVE-2026-53793, CVE-2026-53795, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70456, CVE-2026-70458, CVE-2026-70460, CVE-2026-70461, CVE-2026-70463, CVE-2026-70464) could lead to unauthorized access, data leakage, or denial of service. The vulnerabilities stem from flaws in the code that could be exploited by attackers, potentially allowing them to manipulate file transfers or gain elevated privileges on affected systems. The CVSS score of these vulnerabilities is 8.2, indicating a high severity level.
How To Fix
Minimum fixed version
0:3.1.3-28.el8_10
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the rsync service or disabling it until the update can be applied. This can be done by stopping the rsync daemon with the command:
sudo systemctl stop rsyncd'.
Conclusion
The vulnerabilities in the rsync package pose significant risks to system security. It is crucial to update to the latest patched version to safeguard against potential exploits. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for rsync →
FAQ
rsync is a utility for efficiently transferring and synchronizing files between a local and a remote system.
The vulnerabilities could allow unauthorized access, data leakage, or denial of service, potentially compromising system integrity.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider stopping the rsync daemon to mitigate risks until you can apply the update.
The CVSS score for the vulnerabilities in the rsync package is 8.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
