Samba Rsync vulnerabilities

CVE-2026-41035 [HIGH] CWE-130 CVE-2026-41035: In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

CVE-2008-1720 [HIGH] CWE-119 CVE-2008-1720: Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allo Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.

CVE-2026-29518 [HIGH] CWE-367 CVE-2026-29518: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite a

CVE-2004-2093 [MEDIUM] CVE-2004-2093: Buffer overflow in the open_socket_out function in socket Buffer overflow in the open_socket_out function in socket.c for rsync 2.5.7 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long RSYNC_PROXY environment variable. NOTE: since rsync is not setuid, this issue does not provide any additional privileges beyond those that are already available to the user. Therefore this issue may be REJECTED in

CVE-2026-43619 [MEDIUM] CWE-59 CVE-2026-43619: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system ca Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timi

CVE-2007-4091 [MEDIUM] CVE-2007-4091: Multiple off-by-one errors in the sender Multiple off-by-one errors in the sender.c in rsync 2.6.9 might allow remote attackers to execute arbitrary code via directory names that are not properly handled when calling the f_name function.

CVE-2014-2855 [HIGH] CWE-20 CVE-2014-2855: The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to ca The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.

CVE-2006-2083 [HIGH] CVE-2006-2083: Integer overflow in the receive_xattr function in the extended attributes patch (xattr Integer overflow in the receive_xattr function in the extended attributes patch (xattr.c) for rsync before 2.6.8 might allow attackers to execute arbitrary code via crafted extended attributes that trigger a buffer overflow.

CVE-2026-43617 [MEDIUM] CWE-289 CVE-2026-43617: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's ho Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to den

CVE-2011-1097 [MEDIUM] CWE-119 CVE-2011-1097: rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows rem rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.

CVE-2024-12747 [MEDIUM] CVE-2024-12747: A flaw was found in rsync A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive inf

CVE-2004-0426 [MEDIUM] CVE-2004-0426: rsync before 2 rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, which allows remote attackers to write files outside of the module's path.

CVE-2026-43620 [MEDIUM] CWE-125 CVE-2026-43620: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted en

CVE-2025-10158 [MEDIUM] CVE-2025-10158: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array ind A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.

CVE-2004-0792 [MEDIUM] CVE-2004-0792: Directory traversal vulnerability in the sanitize_path function in util Directory traversal vulnerability in the sanitize_path function in util.c for rsync 2.6.2 and earlier, when chroot is disabled, allows attackers to read or write certain files.

CVE-2017-17433 [LOW] CWE-862 CVE-2017-17433: The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 201 The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

CVE-2026-45232 [LOW] CWE-193 CVE-2026-45232: Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the est Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy se

CVE-2002-0080 [LOW] CWE-269 CVE-2002-0080: rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, whi rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.