{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/vex/2026/cve-2026-53792-els_os-debian11els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-18T13:36:39Z",
      "generator": {
        "date": "2026-09-18T13:36:39Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-53792-ELS_OS-DEBIAN11ELS",
      "initial_release_date": "2026-08-13T15:19:00Z",
      "revision_history": [
        {
          "date": "2026-08-13T15:19:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T12:45:34Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-09-18T13:36:39Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2026-53792"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4.armel",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4.armel",
                  "product_id": "rsync-0:3.2.3-4+deb11u4.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/debian/rsync@3.2.3-4%2Bdeb11u4?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4.amd64",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4.amd64",
                  "product_id": "rsync-0:3.2.3-4+deb11u4.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/debian/rsync@3.2.3-4%2Bdeb11u4?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4.arm64",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4.arm64",
                  "product_id": "rsync-0:3.2.3-4+deb11u4.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/debian/rsync@3.2.3-4%2Bdeb11u4?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel",
                  "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=armel"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel",
                  "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els4?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64",
                  "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64",
                  "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els4?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64",
                  "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els3?arch=arm64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64",
                "product": {
                  "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64",
                  "product_id": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/rsync@3.2.3-4%2Bdeb11u4%2Btuxcare.els4?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4.armel as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4.armel"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64 as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4.amd64 as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4.amd64"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4.amd64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64 as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4.arm64 as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4.arm64"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64 as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64 as a component of Debian 11",
          "product_id": "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64"
        },
        "product_reference": "rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53792",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "notes": [
        {
          "category": "description",
          "text": "rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64",
          "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64",
          "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel",
          "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64",
          "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64",
          "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel",
          "Debian-11:rsync-0:3.2.3-4+deb11u4.amd64",
          "Debian-11:rsync-0:3.2.3-4+deb11u4.arm64",
          "Debian-11:rsync-0:3.2.3-4+deb11u4.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53792"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0",
          "url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw",
          "url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block",
          "url": "https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block"
        }
      ],
      "release_date": "2026-08-13T15:19:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-09-09T12:16:35.771926Z",
          "details": "This flaw is only reachable during an active rsync transfer where your system is acting as the sender and the peer (receiver) is malicious; it cannot be hit by unsolicited network traffic or a passive listener. The condition results in an out‑of‑bounds read (no write), so the realistic impact is limited to a sender‑process crash or, at worst, a small adjacent‑memory disclosure without code execution or privilege escalation. If you do not initiate pushes to untrusted hosts or expose an rsync daemon that serves arbitrary receivers, the required preconditions are absent, making this a safe candidate to deprioritize.",
          "product_ids": [
            "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.amd64",
            "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.arm64",
            "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els3.armel",
            "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.amd64",
            "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.arm64",
            "Debian-11:rsync-0:3.2.3-4+deb11u4+tuxcare.els4.armel",
            "Debian-11:rsync-0:3.2.3-4+deb11u4.amd64",
            "Debian-11:rsync-0:3.2.3-4+deb11u4.arm64",
            "Debian-11:rsync-0:3.2.3-4+deb11u4.armel"
          ]
        }
      ]
    }
  ]
}