Skip to content

GHSA-cg57-rp9g-56hw on Cyberus Linux 26.05

Aliases: GHSA-cg57-rp9g-56hw, CVE-2026-53792

Packages: rsync

Status: In Progress

Advisory Information

A malicious receiver sending a checksum header with count > 0 and block length == 0 made the sender's rolling-match arithmetic compute a negative offset.

Fix: reject a checksum header with a zero block length.

Test: checksum-zero-blocklen.

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-31 17:32 CEST

Metadata changes:

  • Status for package rsync: “In Progress” (9b9ebeee7b4bd3be63ce8cc0a23b403542478f68)

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”