The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rsync-rrsyncUpgrade rsyncUpgrade rsync-daemon | Oct 11, 2026 | Sep 14, 2026 |
| Alpine Linux | — | Upgrade rsync | Sep 1, 2026 | Aug 13, 2026 |
| Amazon_linux_2023 | — | Upgrade rsync-debuginfoUpgrade rsyncUpgrade rsync-debugsourceUpgrade rsync-daemon | Sep 30, 2026 | Aug 13, 2026 |
| Debian | — | Upgrade rsync | Sep 30, 2026 | Aug 13, 2026 |
| Freebsd | — | Upgrade rsync | Aug 27, 2026 | Aug 25, 2026 |
| Oracle_linux | — | Upgrade rsyncUpgrade rsync-daemonUpgrade rsync-rrsync | Oct 22, 2026 | Aug 13, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Oct 1, 2026 | Aug 13, 2026 |
| Redhat_linux | — | Upgrade rsync-debuginfoUpgrade rsync-debugsourceUpgrade rsyncNo solution existsUpgrade rsync-rrsyncUpgrade rsync-daemon | Aug 24, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade rsyncUpgrade rsync-debuginfoUpgrade rsync-debugsource | Sep 17, 2026 | Sep 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub