Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
1648 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 35 critical, 622 high, 819 medium, 170 low.
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
High [CVE-2026-19693] Arbitrary file write via symlink in archive
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory. By crafting a malicious zip archive containing a symbolic link (symlink) and a regular file with the same name, the attacker can bypass security checks. The extract-zip utility incorrectly validates only the parent directory, enabling the attacker to write files to arbitrary locations on the system. The flaw arises from insufficient validation of archive entries, allowing a remote attacker to write files to arbitrary locations on the system by providing a specially crafted zip archive. This requires user interaction to extract the malicious archive, but successful exploitation could lead to significant system integrity and availability compromise. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Weakness: CWE-59. Affected products named by the advisory: Node HealthCheck Operator; OpenShift Pipelines; Red Hat Build of Podman Desktop; Red Hat Ceph Storage 4; and 6 more.
High [CVE-2026-73194] DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected. When processing an untrusted statement, a specially crafted numeric placeholder can cause the binder counter to become negative. This results in subsequent placeholders expanding beyond their allocated buffer, leading to memory corruption. An attacker could exploit this to potentially achieve arbitrary code execution or cause a denial of service.
High [CVE-2026-73193] Arbitrary Code Execution on 32-bit Perl via Integer Wraparound
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes. A flaw was found in DBI. A remote attacker can exploit this by providing a specially crafted, excessively large statement. This can lead to a heap out-of-bounds write, potentially allowing the attacker to execute arbitrary code or cause a denial of service. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-787.
High [CVE-2026-56860] golang net/url: Denial of Service from quadratic complexity in path resolution
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. A flaw was found in `net/url`, a component of `golang`. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion. This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments ('..') may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
High [CVE-2026-56853] Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. A flaw was found in the `net/http` component of the Go standard library. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources. Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 52 more. Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Custom Metric Autoscaler 2.19; external secrets operator for Red Hat OpenShift 1.2; Logging Subsystem for Red Hat OpenShift 6.6; and 48 more.
High [CVE-2026-56858] Go html/template: Cross-Site Scripting via pathological input
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. A flaw was found in the `html/template` component of Go (golang). This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions. This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-79. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 53 more. Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Custom Metric Autoscaler 2.19; external secrets operator for Red Hat OpenShift 1.2; Logging Subsystem for Red Hat OpenShift 6.6; and 49 more.
High [CVE-2026-56862] Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. A flaw was found in the `crypto/tls` package, part of `golang`. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1050. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 52 more.
High [CVE-2026-33818] Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-776. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 51 more. Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Custom Metric Autoscaler 2.19; external secrets operator for Red Hat OpenShift 1.2; Logging Subsystem for Red Hat OpenShift 6.6; and 47 more.
High [CVE-2026-56859] Denial of Service via XML decoding recursion depth issue
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-776. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 53 more. Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Custom Metric Autoscaler 2.19; Logging Subsystem for Red Hat OpenShift 6.6; OpenShift API for Data Protection 1.5; and 49 more.
High [CVE-2026-73566] Denial of Service via crafted long-path tar archive
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the `filesFilter` function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives. Important: A denial of service vulnerability exists in the `node-tar` library, affecting Node.js applications that process untrusted tar archives with member selection. This is considered Important due to the potential for service disruption in applications handling untrusted archive content. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
High [CVE-2026-73515] Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service. A flaw was found in PostGIS. This can lead to sensitive information disclosure or a denial of service. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:65899. Affected products named by the advisory: Red Hat package: postgresql16-postgis; Red Hat package: postgresql18-postgis.
High [CVE-2026-70452] rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees. A flaw was found in rsync. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-636. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70455] Denial of Service via Zstandard compression thread exhaustion
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads. RHEL 9 and older versions are unaffected. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10. Red Hat fixing advisory: RHSA-2026:67463. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70456] Heap Out-of-Bounds Write via crafted argument list
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory. A flaw was found in rsync. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code execution. This is an Important severity flaw in rsync, allowing a remote attacker to corrupt heap memory via a specially crafted argument list. The vulnerability, exploitable without authentication or user interaction, could lead to denial of service or potentially arbitrary code execution, elevating its impact beyond Moderate due to the remote, unauthenticated nature of the attack. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70458] Memory corruption via crafted file entries
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data. A flaw was found in rsync. This can lead to denial of service or other unpredictable system behavior. This Important out-of-bounds write vulnerability in rsync can lead to memory corruption when processing specially crafted file entries, potentially resulting in a denial of service. The flaw is triggered when hard-link preservation is inactive, allowing a remote attacker to exploit it without requiring user interaction or elevated privileges. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70460] rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent. A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70461] Information disclosure and denial of service via crafted files-from entry
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer. A flaw was found in rsync. This can lead to information disclosure or denial of service. This can be exploited against read-only rsync daemon modules, making it a significant risk for publicly exposed rsync services. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70463] Authorization bypass via `auth users` directive parsing
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing. An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain unauthorized access to restricted modules. The flaw allows an authenticated, but unauthorized, user to access restricted rsync modules due to incorrect parsing of deny rules. This bypass occurs because the rsync parser fails to properly tokenize group names with embedded spaces, silently discarding intended access restrictions. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-863.
High [CVE-2026-70464] Denial of Service via handshake stall
rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients. An unauthenticated remote attacker can stall the handshake process by opening multiple concurrent connections and trickling data or stalling prior to module selection. This bypasses standard timeouts and exhausts all available connection slots, preventing legitimate clients from connecting. An unauthenticated remote attacker can exhaust available connection slots by stalling the handshake process, preventing legitimate clients from connecting. This vulnerability primarily affects systems where the rsync daemon is explicitly enabled and exposed to untrusted networks. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more.
High [CVE-2026-53795] Arbitrary file write via --temp-dir or --link-dest options
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process. A flaw was found in rsync. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree, potentially leading to unauthorized data modification or system disruption. This occurs when a user is tricked into executing rsync with attacker-controlled absolute paths via the `--temp-dir` or `--link-dest` options, bypassing path confinement. The requirement for user interaction to supply malicious input prevents this from being a Critical severity issue. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.