Medium severity · published Aug 13, 2026
CVE-2026-53788
rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
rsync · RsyncProject
through 3.4.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53788
github.com
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
github.com
https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4c5-8c68-5fjq
www.vulncheck.com
https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter-uid-gid-mapping
More from rsync
9.1
CVE-2026-53791
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
8.2
CVE-2026-70456
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
8.2
CVE-2026-70457
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
8.2
CVE-2026-70458
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
8.2
CVE-2026-70461
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry