Rsync vulnerabilities
57 published vulnerabilities in Rsync. The most were published this year: 40 so far in 2026.
Rsync vulnerabilities by year
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Rsync vulnerabilities
- CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling
- CVE-2017-17434 The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data str
- CVE-2017-16548 The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, w
- CVE-2017-15994 rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions.
- CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths
- CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
- CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
- CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode
- CVE-2026-70452 rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
- CVE-2026-70456 rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
- CVE-2026-70458 rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
- CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.