7.6
High
CVE-2026-70454 rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation…
Description
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.
Affected products and versions
Other CVEs of rsync
The 44 CVEs of rsync →
CVE-2026-119741
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
8.7
High
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent…
9.1
Critical
CVE-2026-70453
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote…
8.7
High
CVE-2026-70455
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system…
8.7
High