CVE-2026-53792

A flaw was found in rsync. A malicious receiver can exploit an out-of-bounds read vulnerability in the sender-side block matching logic. By sending a specially crafted checksum block with a length of zero, an attacker can trigger memory access before the start of an allocated buffer. This can lead to a denial of service on the sender side.

A Moderate denial of service flaw exists in rsync, where a malicious receiver can trigger an out-of-bounds read on the sending system. This vulnerability requires the sender to connect to a specially crafted malicious rsync server, which can lead to service disruption of file synchronization operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable unused rsyncd services (systemctl disable --now rsyncd), and if actively serving files, restrict port 873 to trusted clients to prevent untrusted pull requests from crashing the daemon. When operating as a client, only push data (rsync src/ host:dst/) to fully trusted receivers, as the out-of-bounds read is triggered by the receiving end.