Debian Updates rsync for 33 Access, Disclosure, and Code-Execution Flaws
Tech GuruQuick Answer
DSA-6527-1 fixes 33 rsync vulnerabilities in Debian 13 (trixie) at 3.5.0+ds1-0+deb13u1. Inventory the executable used at each end of a transfer, including scheduled backup jobs and rsync daemons. Updating the initiating machine does not establish the remote peer's version.
Confirm Scope And Apply The Supported Fix
What to do now: update affected trixie installations through Debian's security repository, coordinating active transfers and daemon restarts. Validate with approved sample data and a disposable destination; do not test changed synchronization behavior against the only backup or a live directory that could be deleted or overwritten.
Last verified: October 2, 2026 UTC against the Debian announcement. No synchronization or restore test was performed.
Scope And Authority
| Product scope | Debian 13 (trixie) rsync packages |
|---|---|
| Advisory | DSA-6527-1 |
| CVEs | CVE-2026-53783, CVE-2026-53784, CVE-2026-53785, CVE-2026-53786, CVE-2026-53788, CVE-2026-53789, CVE-2026-53790, CVE-2026-53791, CVE-2026-53792, CVE-2026-53793, CVE-2026-53794, CVE-2026-53795, CVE-2026-53796, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70452, CVE-2026-70453, CVE-2026-70454, CVE-2026-70455, CVE-2026-70456, CVE-2026-70457, CVE-2026-70458, CVE-2026-70459, CVE-2026-70460, CVE-2026-70461, CVE-2026-70462, CVE-2026-70463, CVE-2026-70464 |
| Authoritative release date | 2026-09-28 20:57:20 UTC (Date header of Debian announcement) |
| Authority revision date | No separate material revision date stated by Debian when verified |
| Affected versions | Debian 13 (trixie) rsync packages before 3.5.0+ds1-0+deb13u1. |
| Fixed version | rsync 3.5.0+ds1-0+deb13u1 for Debian 13 (trixie) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Debian corrected 33 rsync vulnerabilities that could result in local privilege escalation, access-control bypass, information disclosure, denial of service, or arbitrary code execution.
What To Validate Now
- Trace each job. Record its local and remote rsync executable, execution identity, transfer direction and daemon or remote-shell transport. Include automation images and backup appliances without assuming the Debian build applies to all of them.
- Update the matching hosts. Apply
3.5.0+ds1-0+deb13u1on affected trixie systems. Preserve job/configuration definitions and avoid interrupting a transfer without the backup owner's approval. - Test away from production data. Transfer known-good sample files into an isolated destination, then compare content and required permissions/metadata. Test restore into a separate location; never restore over the source merely to demonstrate success.
- Check access boundaries. Confirm that the intended account can reach only its approved paths and that scheduled jobs use the updated executable. Do not weaken authentication or path restrictions to bypass a regression.
- Document both ends. Keep peer versions, job outcomes and unresolved appliances or images. Neither encryption in transit nor a successful copy proves every listed vulnerability is absent.
Operational Cautions
Use the exact Debian 13 security repository and preserve configuration before updating. Coordinate service restarts and test dependent applications; the advisory's impact description is not evidence that a particular environment was exploited.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
