Log in Start free

Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-53788rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

Medium 6.5

In plain English

A medium-severity security flaw in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 80.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21rsync3.5.0-r0ALPINE-CVE-2026-53788
Alpine:v3.22rsync3.5.0-r0ALPINE-CVE-2026-53788
Alpine:v3.23rsync3.5.0-r0ALPINE-CVE-2026-53788
Alpine:v3.24rsync3.5.0-r0ALPINE-CVE-2026-53788
Debian:12rsyncno fix listedDEBIAN-CVE-2026-53788
Debian:13rsync3.5.0+ds1-0+deb13u1DEBIAN-CVE-2026-53788
Debian:14rsync3.5.0+ds1-1DEBIAN-CVE-2026-53788
Ubuntu:22.04:LTSrsyncno fix listedUBUNTU-CVE-2026-53788
Ubuntu:24.04:LTSrsyncno fix listedUBUNTU-CVE-2026-53788
Ubuntu:26.04:LTSrsyncno fix listedUBUNTU-CVE-2026-53788
Ubuntu:26.10rsyncno fix listedUBUNTU-CVE-2026-53788

Affected products (as reported)

VendorProductVersions
RsyncProject rsync 0 – through 3.4.4

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References