Newline Injection Vulnerability in Rsync Daemon by Rsync Project

CVE-2026-53788

What is CVE-2026-53788?

Rsync versions prior to 3.5.0 are susceptible to a newline injection vulnerability within the uid/gid mapping interface. This issue enables local attackers to craft user or group names including newline characters, thereby manipulating protocol messages. By injecting these malicious characters, attackers can corrupt the uid/gid mapping logic, leading the rsync daemon to handle their crafted data as legitimate input. This flaw poses a significant risk by allowing unauthorized data influence, potentially compromising the integrity of the rsync process.

References