CVE-2025-10158
Rsync: Out of bounds array access via negative index
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Rsync: Out of bounds array access via negative index
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-129
- Updated
- 2026-11-02
EUVDEUVD-2025-198005
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
EUVD-2025-198005- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3rvc-qcwh-fhqv
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds...
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
GHSA-3rvc-qcwh-fhqv- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-129
- Updated
- 2026-11-02
NVD
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-10158
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
ALPINE-CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBELL-CVE-2025-10158
- Record
BELL-CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 48 moreShow less
OSV
Rsync: Out of bounds array access via negative index
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-129
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-10158
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
DEBIAN-CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-625
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds...
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
JLSEC-2026-625- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1172
rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)
- Record
OESA-2026-1172- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1173
rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)
- Record
OESA-2026-1173- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1174
rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)
- Record
OESA-2026-1174- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1175
rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)
- Record
OESA-2026-1175- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1176
rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)
- Record
OESA-2026-1176- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVOESA-2026-1177
rsync security update
Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.
Security Fix(es):
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)
- Record
OESA-2026-1177- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:20602
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:20602- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2026:20603
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:20603- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2026:20604
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:20604- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2026:20696
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:20696- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2026:6390
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:6390- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:6436
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:6436- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2026:6825
Red Hat Security Advisory: rsync security update
- Record
RHSA-2026:6825- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRLSA-2026:6390
Moderate: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
- rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:6390- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRLSA-2026:6436
Moderate: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
- rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:6436- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVRLSA-2026:6825
Moderate: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
- rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:6825- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-10158
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
UBUNTU-CVE-2025-10158- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVALSA-2026:6390 No score
Moderate: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
- rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:6390- Updated
- 2026-11-02
OSVALSA-2026:6436 No score
Moderate: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
- rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:6436- Updated
- 2026-11-02
OSVALSA-2026:6825 No score
Moderate: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
- rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:6825- Updated
- 2026-11-02
OSVAZL-70387 No score
CVE-2025-10158 affecting package rsync for versions less than 3.4.1-2
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
AZL-70387- Updated
- 2026-11-02
OSVAZL-70667 No score
CVE-2025-10158 affecting package rsync for versions less than 3.4.1-2
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The
malicious
rsync client requires at least read access to the remote rsync module in order to trigger the issue.
- Record
AZL-70667- Updated
- 2026-11-02
OSVCLSA-2026-1775723827 No score
rsync: Fix of CVE-2025-10158
- CVE-2025-10158: fix invalid access to files array via negative parent_ndx
- Record
CLSA-2026-1775723827- Updated
- 2026-11-02
OSVCLSA-2026-1777469554 No score
rsync: Fix of 2 CVEs
- CVE-2024-12086: prevent server from reading arbitrary client files via path traversal
- CVE-2025-10158: fix invalid access to files array in sender
- Add upstream stability fix (RsyncProject/rsync PR #706): use-after-free in generator
- Enable Amazon Linux 2 ELS
- Record
CLSA-2026-1777469554- Updated
- 2026-11-02
OSVCLSA-2026-1777474126 No score
rsync: Fix of 2 CVEs
- CVE-2024-12086: prevent server from reading arbitrary client files via path traversal
- CVE-2025-10158: fix invalid access to files array in sender
- Add upstream stability fix (RsyncProject/rsync PR #706): use-after-free in generator
- Enable Amazon Linux 2 ELS
- Record
CLSA-2026-1777474126- Updated
- 2026-11-02
OSVCLSA-2026-1777544655 No score
rsync: Fix of 2 CVEs
- CVE-2024-12086: prevent server from reading arbitrary client files via path traversal
- CVE-2025-10158: fix invalid access to files array in sender
- Add upstream stability fix (RsyncProject/rsync PR #706): use-after-free in generator
- Enable Amazon Linux 2 ELS
- Record
CLSA-2026-1777544655- Updated
- 2026-11-02
OSVCLSA-2026-1778236507 No score
rsync: Fix of 3 CVEs
- CVE-2025-10158: fix invalid access to files array in sender
- CVE-2024-12747: fix symlink race condition in sender
- CVE-2024-12086: fix server leak of arbitrary client files via crafted checksums and fuzzy basis
- Record
CLSA-2026-1778236507- Updated
- 2026-11-02
OSVMGASA-2026-0048 No score
Updated rsync packages fix security vulnerability
Out of bounds array access via negative index. (CVE-2025-10158)
- Record
MGASA-2026-0048- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15827-1 No score
rsync-3.4.1-4.1 on GA media
These are all security issues fixed in the rsync-3.4.1-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15827-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20754-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- Record
openSUSE-SU-2026:20754-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20877-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
- Record
openSUSE-SU-2026:20877-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4511-1 No score
Security update for rsync
This update for rsync fixes the following issues:
- CVE-2025-10158: Fixed out-of-bounds array access via negative index (bsc#1254441)
- Record
SUSE-SU-2025:4511-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0005-1 No score
Security update for rsync
This update for rsync fixes the following issues:
- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)
- Record
SUSE-SU-2026:0005-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0041-1 No score
Security update for rsync
This update for rsync fixes the following issues:
- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)
- Record
SUSE-SU-2026:0041-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0069-1 No score
Security update for rsync
This update for rsync fixes the following issues:
- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)
- Record
SUSE-SU-2026:0069-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20044-1 No score
Security update for rsync
This update for rsync fixes the following issues:
- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)
- Record
SUSE-SU-2026:20044-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20058-1 No score
Security update for rsync
This update for rsync fixes the following issues:
- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)
- Record
SUSE-SU-2026:20058-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2038-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
- Record
SUSE-SU-2026:2038-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2048-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
- Record
SUSE-SU-2026:2048-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2083-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
- Record
SUSE-SU-2026:2083-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21726-1 No score
Security update for rsync
This update for rsync fixes the following issues
Security issues:
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Non security issues:
- rsync --delay-updates never updates after interruption (bsc#1204538).
- Fix duplication of flag causing illegal hashkey failures.
- Record
SUSE-SU-2026:21726-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21739-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
- Record
SUSE-SU-2026:21739-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21747-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- Record
SUSE-SU-2026:21747-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21795-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- Record
SUSE-SU-2026:21795-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21980-1 No score
Security update for rsync
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
- Record
SUSE-SU-2026:21980-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rsyncAlpine:v3.19 |
before 3.4.1-r1 | 3.4.1-r1 |
rsyncAlpine:v3.20 |
before 3.4.1-r1 | 3.4.1-r1 |
rsyncAlpine:v3.21 |
before 3.4.1-r1 | 3.4.1-r1 |
rsyncAlpine:v3.22 |
before 3.4.1-r1 | 3.4.1-r1 |
rsyncAlpine:v3.23 |
before 3.4.1-r1 | 3.4.1-r1 |
rsyncAlpine:v3.24 |
before 3.4.1-r1 | 3.4.1-r1 |
rsyncAlmaLinux:9 |
before 3.2.5-3.el9_7.2 | 3.2.5-3.el9_7.2 |
rsync-daemonAlmaLinux:9 |
before 3.2.5-3.el9_7.2 | 3.2.5-3.el9_7.2 |
rsync-rrsyncAlmaLinux:9 |
before 3.2.5-3.el9_7.2 | 3.2.5-3.el9_7.2 |
rsyncAlmaLinux:8 |
before 3.1.3-24.el8_10 | 3.1.3-24.el8_10 |
Show 73 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rsync-daemonAlmaLinux:8 |
before 3.1.3-24.el8_10 | 3.1.3-24.el8_10 |
rsync-daemonAlmaLinux:10 |
before 3.4.1-2.el10_1.2 | 3.4.1-2.el10_1.2 |
rsync-rrsyncAlmaLinux:10 |
before 3.4.1-2.el10_1.2 | 3.4.1-2.el10_1.2 |
rsyncAzure Linux:3 |
before 3.4.1-2 | 3.4.1-2 |
rsyncAzure Linux:2 |
before 3.4.1-2 | 3.4.1-2 |
rsyncAlpaquita:23 |
3.2.7-r0 up to 3.2.7-r2 | 3.2.7-r2 |
rsyncAlpaquita:25 |
3.4.1-r0 up to 3.4.1-r1 | 3.4.1-r1 |
rsyncAlpaquita:stream |
3.2.5-r0 up to 3.4.1-r1 | 3.4.1-r1 |
rsyncTuxCare:AlmaLinux:9.6 |
before 3.2.5-3.el9.tuxcare.els1 | 3.2.5-3.el9.tuxcare.els1 |
rsync-daemonTuxCare:AlmaLinux:9.6 |
before 3.2.5-3.el9.tuxcare.els1 | 3.2.5-3.el9.tuxcare.els1 |
rsync-rrsyncTuxCare:AlmaLinux:9.6 |
before 3.2.5-3.el9.tuxcare.els1 | 3.2.5-3.el9.tuxcare.els1 |
rsyncTuxCare:RHEL:7 From an advisory covering 2 CVEs |
before 3.1.2-12.0.1.el7_9.tuxcare.els3 | 3.1.2-12.0.1.el7_9.tuxcare.els3 |
rsyncTuxCare:OracleLinux:7 From an advisory covering 2 CVEs |
before 3.1.2-12.0.1.el7_9.tuxcare.els3 | 3.1.2-12.0.1.el7_9.tuxcare.els3 |
rsyncTuxCare:CentOS:7 From an advisory covering 2 CVEs |
before 3.1.2-12.0.1.el7_9.tuxcare.els3 | 3.1.2-12.0.1.el7_9.tuxcare.els3 |
rsyncTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3.2.3-19.el9.tuxcare.els4 | 3.2.3-19.el9.tuxcare.els4 |
rsync-daemonTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs |
before 3.2.3-19.el9.tuxcare.els4 | 3.2.3-19.el9.tuxcare.els4 |
rsyncDebian:12 |
before 3.2.7-1+deb12u4, plus listed versions 3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u3 |
3.2.7-1+deb12u4 |
rsyncDebian:13 |
before 3.4.1+ds1-5+deb13u1, plus listed versions 3.4.1+ds1-5 |
3.4.1+ds1-5+deb13u1 |
rsyncDebian:14 |
before 3.4.1+ds1-7, plus listed versions 3.4.1+ds1-53.4.1+ds1-6 |
3.4.1+ds1-7 |
rsync_jllJulia |
before 3.4.4+0 | 3.4.4+0 |
rsyncMageia:9 |
before 3.2.7-1.3.mga9 | 3.2.7-1.3.mga9 |
rsyncopenEuler:24.03-LTS-SP2 |
before 3.2.7-7.oe2403sp2 | 3.2.7-7.oe2403sp2 |
rsyncopenEuler:20.03-LTS-SP4 |
before 3.1.3-12.oe2003sp4 | 3.1.3-12.oe2003sp4 |
rsyncopenEuler:22.03-LTS-SP3 |
before 3.2.5-5.oe2203sp3 | 3.2.5-5.oe2203sp3 |
rsyncopenEuler:22.03-LTS-SP4 |
before 3.2.5-5.oe2203sp4 | 3.2.5-5.oe2203sp4 |
rsyncopenEuler:24.03-LTS |
before 3.2.7-7.oe2403 | 3.2.7-7.oe2403 |
rsyncopenEuler:24.03-LTS-SP1 |
before 3.2.7-7.oe2403sp1 | 3.2.7-7.oe2403sp1 |
rsync-daemonRed Hat:rhel_e4s:9.2::appstream From an advisory covering 2 CVEs |
before 0:3.2.3-19.el9_2.3 | 0:3.2.3-19.el9_2.3 |
rsyncRed Hat:rhel_e4s:9.2::baseos From an advisory covering 2 CVEs |
before 0:3.2.3-19.el9_2.3 | 0:3.2.3-19.el9_2.3 |
rsync-daemonRed Hat:rhel_eus:9.6::appstream From an advisory covering 3 CVEs |
before 0:3.2.5-3.el9_6.1 | 0:3.2.5-3.el9_6.1 |
rsyncRed Hat:rhel_eus:9.6::baseos From an advisory covering 3 CVEs |
before 0:3.2.5-3.el9_6.1 | 0:3.2.5-3.el9_6.1 |
rsync-daemonRed Hat:rhel_eus:9.4::appstream From an advisory covering 2 CVEs |
before 0:3.2.3-19.el9_4.3 | 0:3.2.3-19.el9_4.3 |
rsyncRed Hat:rhel_eus:9.4::baseos From an advisory covering 2 CVEs |
before 0:3.2.3-19.el9_4.3 | 0:3.2.3-19.el9_4.3 |
rsync-daemonRed Hat:enterprise_linux_eus:10.0 From an advisory covering 2 CVEs |
before 0:3.4.1-2.el10_0.2 | 0:3.4.1-2.el10_0.2 |
rsyncRed Hat:enterprise_linux_eus:10.0 From an advisory covering 2 CVEs |
before 0:3.4.1-2.el10_0.2 | 0:3.4.1-2.el10_0.2 |
rsync-daemonRed Hat:enterprise_linux:9::appstream |
before 0:3.2.5-3.el9_7.2 | 0:3.2.5-3.el9_7.2 |
rsync-rrsyncRed Hat:enterprise_linux:9::appstream |
before 0:3.2.5-3.el9_7.2 | 0:3.2.5-3.el9_7.2 |
rsyncRed Hat:enterprise_linux:9::baseos |
before 0:3.2.5-3.el9_7.2 | 0:3.2.5-3.el9_7.2 |
rsync-debuginfoRed Hat:enterprise_linux:9::baseos |
before 0:3.2.5-3.el9_7.2 | 0:3.2.5-3.el9_7.2 |
rsync-debugsourceRed Hat:enterprise_linux:9::baseos |
before 0:3.2.5-3.el9_7.2 | 0:3.2.5-3.el9_7.2 |
rsyncRed Hat:enterprise_linux:8::baseos |
before 0:3.1.3-24.el8_10 | 0:3.1.3-24.el8_10 |
rsync-daemonRed Hat:enterprise_linux:8::baseos |
before 0:3.1.3-24.el8_10 | 0:3.1.3-24.el8_10 |
rsync-debuginfoRed Hat:enterprise_linux:8::baseos |
before 0:3.1.3-24.el8_10 | 0:3.1.3-24.el8_10 |
rsync-debugsourceRed Hat:enterprise_linux:8::baseos |
before 0:3.1.3-24.el8_10 | 0:3.1.3-24.el8_10 |
rsync-daemonRed Hat:enterprise_linux:10.1 |
before 0:3.4.1-2.el10_1.2 | 0:3.4.1-2.el10_1.2 |
rsync-rrsyncRed Hat:enterprise_linux:10.1 |
before 0:3.4.1-2.el10_1.2 | 0:3.4.1-2.el10_1.2 |
rsyncRed Hat:enterprise_linux:10.1 |
before 0:3.4.1-2.el10_1.2 | 0:3.4.1-2.el10_1.2 |
rsync-debuginfoRed Hat:enterprise_linux:10.1 |
before 0:3.4.1-2.el10_1.2 | 0:3.4.1-2.el10_1.2 |
rsync-debugsourceRed Hat:enterprise_linux:10.1 |
before 0:3.4.1-2.el10_1.2 | 0:3.4.1-2.el10_1.2 |
rsyncRocky Linux:9 |
before 0:3.2.5-3.el9_7.2 | 0:3.2.5-3.el9_7.2 |
rsyncRocky Linux:8 |
before 0:3.1.3-24.el8_10 | 0:3.1.3-24.el8_10 |
rsyncRocky Linux:10 |
before 0:3.4.1-2.el10_1.2 | 0:3.4.1-2.el10_1.2 |
rsyncSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 3.2.7-150600.3.14.1 | 3.2.7-150600.3.14.1 |
rsyncopenSUSE:Leap 15.6 |
before 3.2.7-150600.3.14.1 | 3.2.7-150600.3.14.1 |
rsyncSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 3.1.3-3.34.1 | 3.1.3-3.34.1 |
rsyncSUSE:Linux Enterprise Micro 5.3 |
before 3.2.3-150400.3.26.1 | 3.2.3-150400.3.26.1 |
rsyncSUSE:Linux Enterprise Micro 5.4 |
before 3.2.3-150400.3.26.1 | 3.2.3-150400.3.26.1 |
rsyncSUSE:Linux Enterprise Micro 5.5 |
before 3.2.3-150400.3.26.1 | 3.2.3-150400.3.26.1 |
rsyncSUSE:Linux Enterprise Micro 5.2 |
before 3.2.3-150000.4.39.1 | 3.2.3-150000.4.39.1 |
rsyncSUSE:Linux Micro 6.0 |
before 3.2.7-5.1 | 3.2.7-5.1 |
rsyncSUSE:Linux Micro 6.1 |
before 3.3.0-slfo.1.1_4.1 | 3.3.0-slfo.1.1_4.1 |
rsyncSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 3.4.1-160000.4.1 | 3.4.1-160000.4.1 |
rsyncSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 3.4.1-160000.4.1 | 3.4.1-160000.4.1 |
rsyncUbuntu:Pro:14.04:LTS |
before 3.1.0-2ubuntu0.4+esm3, plus listed versions 3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.33.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm2 |
3.1.0-2ubuntu0.4+esm3 |
rsyncUbuntu:Pro:16.04:LTS |
before 3.1.1-3ubuntu1.3+esm5, plus listed versions 3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3 Show 4 moreShow less3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm4 |
3.1.1-3ubuntu1.3+esm5 |
rsyncUbuntu:Pro:18.04:LTS |
before 3.1.2-2.1ubuntu1.6+esm3, plus listed versions 3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2 Show 6 moreShow less3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm2 |
3.1.2-2.1ubuntu1.6+esm3 |
rsyncUbuntu:Pro:20.04:LTS |
before 3.1.3-8ubuntu0.9+esm1, plus listed versions 3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3 Show 5 moreShow less3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.9 |
3.1.3-8ubuntu0.9+esm1 |
rsyncUbuntu:22.04:LTS |
before 3.2.7-0ubuntu0.22.04.6, plus listed versions 3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3 Show 4 moreShow less3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.4 |
3.2.7-0ubuntu0.22.04.6 |
rsyncUbuntu:24.04:LTS |
before 3.2.7-1ubuntu1.4, plus listed versions 3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.2 |
3.2.7-1ubuntu1.4 |
rsyncUbuntu:25.10 |
before 3.4.1+ds1-5ubuntu1.2, plus listed versions 3.4.1+ds1-33.4.1+ds1-43.4.1+ds1-53.4.1+ds1-5ubuntu1 |
3.4.1+ds1-5ubuntu1.2 |
rsyncUbuntu:26.04:LTS |
before 3.4.1+ds1-7, plus listed versions 3.4.1+ds1-5ubuntu13.4.1+ds1-6 |
3.4.1+ds1-7 |
rsyncUbuntu:26.04:LTS |
before 3.4.1+ds1-7ubuntu0.2, plus listed versions 3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-7 |
3.4.1+ds1-7ubuntu0.2 |
rsyncopenSUSE:Tumbleweed |
before 3.4.1-4.1 | 3.4.1-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-10158 is a medium vulnerability (CVSS 4.3) in Rsync, published November 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in rsync 3.4.1-r1.
References
github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f
attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1
nvd.nist.gov/vuln/detail/CVE-2025-10158
security.alpinelinux.org/vuln/CVE-2025-10158
access.redhat.com/errata/RHSA-2026:6390
Show 114 moreShow less
bugzilla.redhat.com/2415637
errata.almalinux.org/9/ALSA-2026-6390.html
docs.bell-sw.com/security/cves/CVE-2025-10158
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775723827.html
security-tracker.debian.org/tracker/CVE-2025-10158
advisories.mageia.org/MGASA-2026-0048.html
bugs.mageia.org/show_bug.cgi?id=35177
lists.fedoraproject.org/archives/list/[email protected]/message/QZOPBIA4TYYH7HBPKXO4XFIWVXML27HR
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1172
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20602.json
cve.org/CVERecord?id=CVE-2025-10158
openwall.com/lists/oss-security/2026/04/16/2
kb.cert.org/vuls/id/952657
issues.redhat.com/browse/RHEL-174895
errata.rockylinux.org/RLSA-2026:6390
suse.com/support/update/announcement/2025/suse-su-20254511-1
bugzilla.suse.com/1254441
ubuntu.com/security/CVE-2025-10158
Left out on purpose, here and in the API, to keep responses small: 3 source records.