CVE-2026-53788

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A newline injection issue exists in the name-converter uid/gid mapping interface. Local attackers can forge protocol messages by creating user or group names that include newline characters. By injecting these characters into names sent via the pipe-based line-oriented protocol, an attacker can trick the rsync daemon into treating malicious data as legitimate protocol input, which corrupts the uid/gid mapping logic.

Recommendations Update rsync to version 3.5.0 or later.