Every CVESearch/Get API key

CVE-2026-43617

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

6.3 MediumFix available

CVE-2026-43617 is a medium vulnerability (CVSS 6.3) in Rsyncproject Rsync, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in rsync 3.4.3-r0.

What does this mean?
Severity
6.3 MediumCVSS 4.0, CVE List
Exploit chance
0.28%EPSS, 20th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.4.3-r0rsync +38 more

Description

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.28%Up 0.3 points since May 20, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rsync
Alpine:v3.20
before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.21
before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.22
before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.23
before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.24
before 3.4.3-r0
3.4.3-r0
rsync
Azure Linux:3
before 3.4.3-1
3.4.3-1
rsync
Alpaquita:23
3.2.7-r0 up to 3.4.3-r0
3.4.3-r0
rsync
Alpaquita:25
3.4.1-r0 up to 3.4.3-r0
3.4.3-r0
rsync
Alpaquita:stream
3.2.5-r0 up to 3.4.3-r0
3.4.3-r0
rsync
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
before 3.2.5-3.el9_6.tuxcare.els4
3.2.5-3.el9_6.tuxcare.els4
Show 29 moreShow less
Affected packages
PackageAffectedFixed
rsync-daemon
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
before 3.2.5-3.el9_6.tuxcare.els4
3.2.5-3.el9_6.tuxcare.els4
rsync-rrsync
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
before 3.2.5-3.el9_6.tuxcare.els4
3.2.5-3.el9_6.tuxcare.els4
rsync
TuxCare:AlmaLinux:9.2
before 3.2.3-19.el9_2.tuxcare.els10
3.2.3-19.el9_2.tuxcare.els10
rsync-daemon
TuxCare:AlmaLinux:9.2
before 3.2.3-19.el9_2.tuxcare.els10
3.2.3-19.el9_2.tuxcare.els10
rsync
Debian:12
before 3.2.7-1+deb12u5, plus listed versions
3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u33.2.7-1+deb12u4
3.2.7-1+deb12u5
rsync
Debian:13
before 3.4.1+ds1-5+deb13u3, plus listed versions
3.4.1+ds1-53.4.1+ds1-5+deb13u13.4.1+ds1-5+deb13u2
3.4.1+ds1-5+deb13u3
rsync
Debian:14
before 3.4.3+ds1-1, plus listed versions
3.4.1+ds1-53.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-2
3.4.3+ds1-1
rsync_jll
Julia
before 3.4.4+0
3.4.4+0
rsync
Mageia:10
From an advisory covering 6 CVEs
before 3.4.1-4.1.mga10
3.4.1-4.1.mga10
rsync
Mageia:9
From an advisory covering 6 CVEs
before 3.2.7-1.5.mga9
3.2.7-1.5.mga9
rsync
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
before 3.2.7-13.oe2403sp1
3.2.7-13.oe2403sp1
rsync
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
before 3.2.7-13.oe2403sp3
3.2.7-13.oe2403sp3
rsync
openEuler:24.03-LTS-SP4
From an advisory covering 2 CVEs
before 3.2.7-13.oe2403sp4
3.2.7-13.oe2403sp4
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
before 3.4.1-160000.4.1
3.4.1-160000.4.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
before 3.4.1-160000.4.1
3.4.1-160000.4.1
rsync
SUSE:Linux Micro 6.0
From an advisory covering 37 CVEs
before 3.2.7-8.1
3.2.7-8.1
rsync
SUSE:Linux Micro 6.2
From an advisory covering 41 CVEs
before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 41 CVEs
before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 41 CVEs
before 3.4.1-160000.6.1
3.4.1-160000.6.1
rsync
Ubuntu:Pro:14.04:LTS
before 3.1.0-2ubuntu0.4+esm3, plus listed versions
3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.33.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm2
3.1.0-2ubuntu0.4+esm3
rsync
Ubuntu:Pro:16.04:LTS
before 3.1.1-3ubuntu1.3+esm5, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3
Show 4 moreShow less
3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm4
3.1.1-3ubuntu1.3+esm5
rsync
Ubuntu:Pro:18.04:LTS
before 3.1.2-2.1ubuntu1.6+esm3, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2
Show 6 moreShow less
3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm2
3.1.2-2.1ubuntu1.6+esm3
rsync
Ubuntu:Pro:20.04:LTS
before 3.1.3-8ubuntu0.9+esm1, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
Show 5 moreShow less
3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.9
3.1.3-8ubuntu0.9+esm1
rsync
Ubuntu:22.04:LTS
before 3.2.7-0ubuntu0.22.04.6, plus listed versions
3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3
Show 4 moreShow less
3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.4
3.2.7-0ubuntu0.22.04.6
rsync
Ubuntu:24.04:LTS
before 3.2.7-1ubuntu1.4, plus listed versions
3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.2
3.2.7-1ubuntu1.4
rsync
Ubuntu:25.10
before 3.4.1+ds1-5ubuntu1.2, plus listed versions
3.4.1+ds1-33.4.1+ds1-43.4.1+ds1-53.4.1+ds1-5ubuntu1
3.4.1+ds1-5ubuntu1.2
rsync
Ubuntu:26.04:LTS
before 3.4.1+ds1-7ubuntu0.2, plus listed versions
3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-7
3.4.1+ds1-7ubuntu0.2
rsync
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
before 3.4.3-1.1
3.4.3-1.1
rsync
openSUSE:Leap 16.0
From an advisory covering 41 CVEs
before 3.4.1-160000.6.1
3.4.1-160000.6.1

What each source reports

CVE List Score used6.3

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
CVE-2026-43617
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-289
Updated
2026-11-08
EUVDEUVD-2026-310136.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
EUVD-2026-31013
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-08
GitHub AdvisoriesGHSA-4j4q-473w-9q2r6.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's...

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
GHSA-4j4q-473w-9q2r
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-289
Updated
2026-11-02
NVD6.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
CVE-2026-43617
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-289
Updated
2026-11-02
OSVALPINE-CVE-2026-436176.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
ALPINE-CVE-2026-43617
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-436174.8
Record
BELL-CVE-2026-43617
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 24 moreShow less
OSV6.3

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
CVE-2026-43617
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-289
Updated
2026-11-09
OSVDEBIAN-CVE-2026-436176.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
DEBIAN-CVE-2026-43617
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVJLSEC-2026-6286.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's...

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
JLSEC-2026-628
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-47527.0

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.(CVE-2026-29518)

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.(CVE-2026-43617)

Record
OESA-2026-4752
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-11
OSVOESA-2026-47537.0

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.(CVE-2026-29518)

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.(CVE-2026-43617)

Record
OESA-2026-4753
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-11
OSVOESA-2026-47547.0

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.(CVE-2026-29518)

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.(CVE-2026-43617)

Record
OESA-2026-4754
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-11
OSVUBUNTU-CVE-2026-436176.3

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
UBUNTU-CVE-2026-43617
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-86994No score

CVE-2026-43617 affecting package rsync for versions less than 3.4.3-1

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Record
AZL-86994
Updated
2026-11-02
OSVCLSA-2026-1779787578No score

rsync: Fix of 2 CVEs

  • CVE-2026-43620: fix client SIGSEGV via parent_ndx<0 in receiver
  • CVE-2026-43617: fix hostname ACL bypass via post-chroot DNS lookup
Record
CLSA-2026-1779787578
Updated
2026-11-02
OSVCLSA-2026-1780945931No score

rsync: Fix of CVE-2026-43617

  • CVE-2026-43617: fix hostname ACL bypass when using daemon chroot by performing the reverse-DNS lookup before entering the chroot so client_name() caches a usable hostname and "hosts deny" rules match
Record
CLSA-2026-1780945931
Updated
2026-11-02
OSVMGASA-2026-0265No score

Updated rsync package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. (CVE-2026-29518) Rsync < 3.4.3 Authorization Bypass via Hostname Resolution. (CVE-2026-43617) Rsync < 3.4.3 Integer Overflow Information Disclosure. (CVE-2026-43618) Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls. (CVE-2026-43619) Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files(). (CVE-2026-43620) Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy. (CVE-2026-45232)

Record
MGASA-2026-0265
Updated
2026-11-02
OSVopenSUSE-SU-2026:10857-1No score

rsync-3.4.3-1.1 on GA media

These are all security issues fixed in the rsync-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10857-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20877-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
openSUSE-SU-2026:20877-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21650-1No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
openSUSE-SU-2026:21650-1
Updated
2026-11-02
OSVSUSE-SU-2026:2038-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2038-1
Updated
2026-11-02
OSVSUSE-SU-2026:2048-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2048-1
Updated
2026-11-02
OSVSUSE-SU-2026:2083-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2083-1
Updated
2026-11-02
OSVSUSE-SU-2026:21726-1No score

Security update for rsync

This update for rsync fixes the following issues

Security issues:

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Non security issues:

  • rsync --delay-updates never updates after interruption (bsc#1204538).
  • Fix duplication of flag causing illegal hashkey failures.
Record
SUSE-SU-2026:21726-1
Updated
2026-11-02
OSVSUSE-SU-2026:21739-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:21739-1
Updated
2026-11-02
OSVSUSE-SU-2026:21980-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:21980-1
Updated
2026-11-02
OSVSUSE-SU-2026:22015-1No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:22015-1
Updated
2026-11-02
OSVSUSE-SU-2026:23253-1No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23253-1
Updated
2026-11-02
OSVSUSE-SU-2026:23289-1No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23289-1
Updated
2026-11-02
OSVSUSE-SU-2026:23323-1No score

Security update for rsync

This update for rsync fixes the following issues:

  • CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
  • CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" (bsc#1269042).
  • CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
  • CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
  • CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
  • CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
  • CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
  • CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
  • CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
  • CVE-2026-53793: Chroot "/./" inner-module escape via a parent-component symlink (bsc#1269051).
  • CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
  • CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement (bsc#1269053).
  • CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
  • CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
  • CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
  • CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
  • CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree (bsc#1269057).
  • CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure (bsc#1269058).
  • CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
  • CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths (bsc#1269040).
  • CVE-2026-70452: hosts deny fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block (bsc#1273441).
  • CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
  • CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
  • CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
  • CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs (bsc#1273437).
  • CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
  • CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
  • CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root (bsc#1273434).
  • CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in- module symlink (bsc#1273433).
  • CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
  • CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
  • CVE-2026-70463: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule (bsc#1273430).
  • CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
Record
SUSE-SU-2026:23323-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, referencesCVE List, EUVD, OSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 140 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open