CVE-2026-53788

A newline injection vulnerability exists in rsync's uid/gid mapping process. An attacker can inject newline characters into user or group names, causing the rsync daemon to process attacker-controlled data as legitimate protocol input. This results in data corruption within the uid/gid mapping logic.

A Moderate severity vulnerability in rsync allows an unauthenticated, remote attacker to inject newline characters into user or group names. Under highly complex conditions, this injection forces rsync to process forged protocol messages, leading to limited data corruption within the uid/gid mapping logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not set name converter in rsyncd.conf unless you need chroot uid/gid lookups. Restrict rsyncd (TCP 873) to trusted clients; if the daemon is unused, disable rsyncd.service. If a converter is required, keep it on a trusted network