On 28 September 2026 Debian published DSA-6527-1, moving rsync in Debian 13 (trixie) to upstream 3.5.0. That release fixes 33 security issues from an audit of rsync's path handling and daemon protocol. Earlier, on 20 May 2026, DSA-6282-1 fixed a smaller set for both Debian 12 and 13. Debian 12 (bookworm) has not yet received the September fixes.
At a glance
| Release | Install at least | Advisory | Status of the 33 September CVEs |
|---|---|---|---|
| Debian 13 (trixie) | 3.5.0+ds1-0+deb13u1 | DSA-6527-1 (28 Sep 2026) | Fixed |
| Debian 12 (bookworm) | 3.2.7-1+deb12u5 | DSA-6282-1 (20 May 2026) | Listed as open in the Debian tracker on 31 Oct 2026 |
Severity: Critical by the rsync project's own label for CVE-2026-53791, which only applies to daemons with proxy protocol = true; most of the others are rated high or medium. None of the CVEs is in CISA's Known Exploited Vulnerabilities catalog (30 Oct 2026).
What the vulnerabilities are
Debian says the September issues could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code, and points to the rsync 3.5.0 NEWS for details. The upstream notes group them as follows:
- Symlink following by a privileged rsync. A local user who controls part of a path plants a symlink that rsync running as root then follows. CVE-2026-53803 (high) can redirect writes such as
--log-fileor batch files, for example appending toauthorized_keys; CVE-2026-53802 (high) can read an arbitrary file through filter, files-from or password files. - Daemon access control. CVE-2026-53791 (critical) lets a client spoof its source address with a PROXY header when
proxy protocol = true. CVE-2026-70452 makeshosts denyfail open when a listed hostname cannot be resolved. CVE-2026-53784 is a module-root escape withuse chroot = no. - Injection and memory safety. CVE-2026-53790 covers command or argument injection through unquoted host or peer values in
RSYNC_CONNECT_PROG, daemon exec hooks and rsync-ssl. Several heap out-of-bounds writes can crash or corrupt the daemon. - Availability. CVE-2026-70464 lets an unauthenticated peer hold daemon connections open past
max connections. - rrsync. CVE-2026-53783 is an escape from the restricted directory of
rrsync, the SSH wrapper often used for backup accounts.
The May update (DSA-6282-1) fixed, among others, CVE-2026-43618, an integer overflow that could leak process memory to an authenticated daemon peer, and symlink races in daemons with use chroot = no (CVE-2026-29518, CVE-2026-43619). The upstream notes say the default use chroot = yes is not exposed to those races.
Are you affected?
apt policy rsync
systemctl is-active rsync
grep -nE 'use chroot|proxy protocol|hosts (allow|deny)' /etc/rsyncd.confEvery machine with rsync installed should be updated, but the daemon, root-run backup jobs and rrsync accounts are where most of these issues bite.
How to update
sudo apt update
sudo apt install --only-upgrade rsyncOn Debian 13 this installs 3.5.0. Its NEWS lists behaviour changes worth testing in backup scripts: a symlinked destination directory is followed only if the link is owned by root or the running user (--insecure-links restores the old behaviour), and proxy protocol = true without proxy protocol hosts now rejects all connections.
Restart or reboot?
No reboot. Restart the daemon where it runs:
sudo systemctl restart rsyncScheduled jobs use the new binary on their next run.
Debian 12 until a fix arrives
Bookworm is now handled by Debian LTS, and the tracker lists the September CVEs as open there. Until a DLA appears, reduce exposure: keep the daemon off the internet or disabled (sudo systemctl disable --now rsync), keep the default use chroot = yes, use IP addresses rather than hostnames in hosts allow and hosts deny, and avoid running rsync as root over directories that other users can write to.
Sources
- security-tracker.debian.org/tracker/DSA-6527-1
- debian.org/security/2026/dsa-6527
- lists.debian.org/debian-security-announce/2026/msg00440.html
- security-tracker.debian.org/tracker/DSA-6282-1
- debian.org/security/2026/dsa-6282
- lists.debian.org/debian-security-announce/2026/msg00193.html
- security-tracker.debian.org/tracker/source-package/rsync
- download.samba.org/pub/rsync/NEWS
- cve.org/CVERecord?id=CVE-2026-53791
- cve.org/CVERecord?id=CVE-2026-53790
- cve.org/CVERecord?id=CVE-2026-53803
- cve.org/CVERecord?id=CVE-2026-70452
- cve.org/CVERecord?id=CVE-2026-43618
- manpages.debian.org/bookworm/rsync/rsyncd.conf.5.en.html
- wiki.debian.org/LTS
- cisa.gov/known-exploited-vulnerabilities-catalog
Comments
0 total · 0 threads