CVE-2026-53788: rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1Fixed in 3.5.1+ds1-2Fixed in 3.5.2+ds1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53788?
The severity of CVE-2026-53788 is classified as medium with a score of 6.5.
How do I fix CVE-2026-53788?
To mitigate CVE-2026-53788, upgrade rsync to version 3.5.0 or later.
What type of vulnerability is CVE-2026-53788?
CVE-2026-53788 is classified as a CRLF Injection vulnerability.
Who can exploit CVE-2026-53788?
Local attackers can exploit CVE-2026-53788 by creating user or group names that contain newline characters.
What impact does CVE-2026-53788 have on users?
CVE-2026-53788 allows attackers to forge protocol messages, potentially leading to unintended actions by the rsync service.