* SECURITY UPDATE: CPU exhaustion from a crafted chain of equal weak checksums - debian/patches/CVE-2026-70453.patch: bound the number of same-weak-checksum candidates hash_search() examines per file offset, so a degenerate chain cannot turn the inner loop into an O(file_size * chain_length) scan - CVE-2026-70453 * SECURITY UPDATE: heap out-of-bounds write in read_args() - debian/patches/CVE-2026-70456.patch: reserve room for the trailing NULL before storing it, so a peer argument count landing exactly on the argv allocation cannot write one pointer past the end - CVE-2026-70456 * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT defeats the client's timeout - debian/patches/CVE-2026-70462.patch: reject a non-positive value, cap the peer's value at 24 hours, and make set_io_timeout() arithmetic overflow-safe so a large value cannot wrap allowed_lull negative - CVE-2026-70462 * SECURITY UPDATE: authorization bypass in the "auth users" parser - debian/patches/CVE-2026-70463.patch: parse with conf_strtok so a leading comma splits on commas alone, and a deny or :ro rule naming a group whose name contains a space fires as written - CVE-2026-70463 * SECURITY UPDATE: wild-pointer read in the per-connection daemon child - debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root entry, and require dir_flist to hold an entry before trusting parent_ndx 0 - CVE-2026-70459 * SECURITY UPDATE: out-of-bounds write from a peer-set FLAG_HLINKED - debian/patches/CVE-2026-70458.patch: gate FLAG_HLINKED on preserve_hard_links and exclude directories, so a peer cannot set it while -H is off and have HLINK_BUMP() displace F_SUM() past the extras - the same patch carries upstream aed77143, which closes a separate unassigned out-of-bounds read of that field: start_server() now sets sender_keeps_checksum for a daemon sender using -c with a %C log format, and hard_link_check() requires S_ISREG before the basis compare - CVE-2026-70458 * SECURITY UPDATE: the per-allocation size cap could be switched off - debian/patches/CVE-2026-53794.patch: reject --max-alloc=0, which disabled the cap that is the defence behind CVE-2024-12084 and was forwarded on the wire; the rsync.1 text describing 0 as "no limit" is corrected with it - a value of 0 is now an error rather than "no limit"; see debian/rsync.NEWS - CVE-2026-53794 * SECURITY UPDATE: implied-parent creation escapes the destination tree - debian/patches/CVE-2026-53785.patch: create each component of make_path() through the held-directory-fd primitive, so a planted parent symlink under --relative cannot place the new directories outside the tree - CVE-2026-53785 * SECURITY UPDATE: source address spoofing via the PROXY protocol header - debian/patches/CVE-2026-53791.patch: add the "proxy protocol hosts" global and honour a forwarded address only when the direct socket peer matches it, so a client connecting directly cannot forge its address past hosts allow - "proxy protocol = true" with no "proxy protocol hosts" now refuses every connection and warns at startup, which is upstream's fail-closed default; see debian/rsync.NEWS - CVE-2026-53791 * SECURITY UPDATE: client-supplied --filter merge file bypasses the module filter - debian/patches/CVE-2026-53786.patch: strip the module-dir prefix, when it is actually present, before checking the merge file against the daemon filter list, and treat a filtered file as absent rather than a fatal error - CVE-2026-53786 * SECURITY UPDATE: absolute --temp-dir or --link-dest disables rename confinement - debian/patches/CVE-2026-53795.patch: confine each side of do_rename_at() and do_link_at() independently, so an absolute path on one side no longer drops the other side back to the unconfined call - CVE-2026-53795