CVE-2026-53788
Received Received - Intake

Newline Injection in rsync Before 3.5.0

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53788
EUVD
EUVD-2026-58096

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

rsync before 3.5.0 has a newline injection flaw in the uid/gid mapping interface. Attackers can insert newline characters into user or group names to forge protocol messages. This corrupts the rsync daemon's processing of legitimate protocol input by manipulating the uid/gid mapping logic.

Detection Guidance

Check your rsync version with 'rsync --version'. If it is 3.4.4 or earlier, your system is vulnerable. Additionally, inspect logs for unusual newline characters in user or group names during rsync operations.

Impact Analysis

An attacker could exploit this to send malicious requests to the rsync daemon, potentially causing unauthorized actions or data corruption. Since it requires no privileges or user interaction, any system running vulnerable rsync versions is at risk of protocol manipulation.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, disable the name-converter uid/gid mapping interface or restrict access to rsync daemon to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart