CVE-2026-53788 rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
Local attackers can inject newlines into user/group names to forge rsync protocol messages, corrupting uid/gid mapping logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53788?
CVE-2026-53788 is a medium-severity vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.
Weakness: CWE-93
Which versions are affected by CVE-2026-53788?
How do I fix CVE-2026-53788?
Upgrade to a fixed version.
Is CVE-2026-53788 being exploited?
There is no known exploitation of CVE-2026-53788 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-53788, AZL-95819, BELL-CVE-2026-53788, DEBIAN-CVE-2026-53788, ECHO-f204-a32d-c6d7, GHSA-p4c5-8c68-5fjq and 1 more.