Rsyncproject Rsync vulnerabilities

CVE-2026-43618 [HIGH] CWE-125 CVE-2026-43618: Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token deco Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability

CVE-2026-44508 [HIGH] CWE-190 CVE-2026-44508: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver's compressed-token decoder accumulated a 32-bit signed counter without checking for overflow. A malicious sender can trigger an overflow that with careful manipulation can lead to the extraction of data stor

CVE-2026-29518 [HIGH] CWE-367 CVE-2026-29518: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite a

CVE-2026-43619 [MEDIUM] CWE-59 CVE-2026-43619: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system ca Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timi

CVE-2026-44509 [MEDIUM] CWE-59 CVE-2026-44509: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open() calls missed races in other path based system calls like chmod() and chown(). For rsync daemons with "use chroot = no" this allows an attacker with local filesystem access

CVE-2026-43617 [MEDIUM] CWE-289 CVE-2026-43617: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's ho Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to den

CVE-2026-44510 [MEDIUM] CWE-125 CVE-2026-44510: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv_files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully

CVE-2026-44507 [MEDIUM] CWE-863 CVE-2026-44507: Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local fi Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/re

CVE-2026-43620 [MEDIUM] CWE-125 CVE-2026-43620: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted en

CVE-2026-45232 [LOW] CWE-193 CVE-2026-45232: Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the est Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy se