Skip to content

GHSA-p4c5-8c68-5fjq on CTRL-OS 26.05

Aliases: GHSA-p4c5-8c68-5fjq, CVE-2026-53788

Packages: rsync

Status: Plausible

Advisory Information

A peer-controlled name containing a newline/CR was written verbatim into the name-converter helper's persistent line protocol, allowing request injection into that channel.

Fix: reject converter tokens containing control characters.

Test: daemon-namecvt-newline-token.

Credit: Mitchell Benjamin (Revamp Studio).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”