{"id":"CVE-2026-43618","aliases":["ALPINE-CVE-2026-43618","ALSA-2026:26332","ALSA-2026:26408","ALSA-2026:26410","AZL-86988","BELL-CVE-2026-43618","CLSA-2026-1779368965","CLSA-2026-1779369352","CLSA-2026-1779369622","CLSA-2026-1779369649","CLSA-2026-1779369849","CLSA-2026-1779438231","CLSA-2026-1779455173","CLSA-2026-1779466465","CLSA-2026-1779711183","CLSA-2026-1779711647","CLSA-2026-1779712103","CLSA-2026-1779823985","CLSA-2026-1779824462","CLSA-2026-1779869103","DEBIAN-CVE-2026-43618","EUVD-2026-31011","GHSA-88m5-cm5m-2596","GHSA-g37v-g3gj-pmwq","JLSEC-2026-629","MGASA-2026-0265","OESA-2026-2502","OESA-2026-2503","OESA-2026-2504","OESA-2026-2505","OESA-2026-2550","RHSA-2026:26332","RHSA-2026:26408","RHSA-2026:26410","RLSA-2026:26332","RLSA-2026:26408","RLSA-2026:26410","SUSE-SU-2026:2038-1","SUSE-SU-2026:2048-1","SUSE-SU-2026:2083-1","SUSE-SU-2026:21726-1","SUSE-SU-2026:21739-1","SUSE-SU-2026:21980-1","SUSE-SU-2026:22015-1","SUSE-SU-2026:23253-1","SUSE-SU-2026:23289-1","SUSE-SU-2026:23323-1","UBUNTU-CVE-2026-43618","openSUSE-SU-2026:10857-1","openSUSE-SU-2026:20877-1","openSUSE-SU-2026:21650-1"],"status":"published","title":"Rsync \u003c 3.4.3 Integer Overflow Information Disclosure","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","severity":{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0078,"percentile":0.56249,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-190"],"published":"2026-05-20T00:00:00Z","modified":"2026-10-29T11:32:34Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","fixed_in":["3.1.3-19.el8.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","fixed_in":["3.1.3-19.el8.1.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","fixed_in":["3.2.3-19.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","fixed_in":["3.2.3-19.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"rsync","fixed_in":["3.1.3-8ubuntu0.9+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","fixed_in":["3.2.5-3.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.7-1+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.4.1+ds1-5+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.4.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"rsync_jll","fixed_in":["3.4.4+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","fixed_in":["3.1.0-2ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rsync","fixed_in":["3.2.7-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rsync","fixed_in":["3.4.1+ds1-5ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rsync","fixed_in":["3.4.1+ds1-7ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u5"}]}],"versions":["3.2.7-1","3.2.7-1+deb12u1","3.2.7-1+deb12u2","3.2.7-1+deb12u3","3.2.7-1+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5+deb13u3"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-5+deb13u1","3.4.1+ds1-5+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3+ds1-1"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1","3.4.2+ds1-1","3.4.2+ds1-2"]},{"source":"osv","ecosystem":"Julia","package":"rsync_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.5.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-8.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-10.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-10.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-10.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-14.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-1.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-27.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-8.1"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm3"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm5"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm3"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+esm1"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.6"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.4"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5ubuntu1.2"}]}],"versions":["3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-5","3.4.1+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7ubuntu0.2"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6","3.4.1+ds1-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.6.1"}]}],"bundled":41}],"products":[{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"rsyncproject","product":"rsync"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.4.3","tags":["release-notes","Release Notes","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/rsync-integer-overflow-information-disclosure","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43618","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469054","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43618.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26332","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26410","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26408","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43618","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-88m5-cm5m-2596","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-43618","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29518","tags":["report"]},{"url":"https://bugzilla.redhat.com/2469054","tags":["report"]},{"url":"https://bugzilla.redhat.com/2469055","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-26332.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-26408.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-26410.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-43618","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779368965.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1779369352.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1779369622.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1779369649.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1779369849.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779438231.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1779455173.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779466465.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1779711183.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1779711647.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1779712103.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1779823985.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1779824462.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1779869103.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43618.json","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43618","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0265.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35562","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/20/6","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00193.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FBOANNVT2JXHE24DJ2WIYE2BNCWRGT24/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/4RPOIF6TVE233FKZN5TAC6XTNQ5WVFYL/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/1","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8349-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45232","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2503","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2504","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2505","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43620","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469055","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-181630","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26332.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29518","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43618","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26408.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26410.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26332","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26408","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:26410","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621980-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622015-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623253-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269039","tags":["report"]},{"url":"https://bugzilla.suse.com/1269040","tags":["report"]},{"url":"https://bugzilla.suse.com/1269041","tags":["report"]},{"url":"https://bugzilla.suse.com/1269042","tags":["report"]},{"url":"https://bugzilla.suse.com/1269043","tags":["report"]},{"url":"https://bugzilla.suse.com/1269044","tags":["report"]},{"url":"https://bugzilla.suse.com/1269045","tags":["report"]},{"url":"https://bugzilla.suse.com/1269046","tags":["report"]},{"url":"https://bugzilla.suse.com/1269047","tags":["report"]},{"url":"https://bugzilla.suse.com/1269048","tags":["report"]},{"url":"https://bugzilla.suse.com/1269049","tags":["report"]},{"url":"https://bugzilla.suse.com/1269050","tags":["report"]},{"url":"https://bugzilla.suse.com/1269051","tags":["report"]},{"url":"https://bugzilla.suse.com/1269052","tags":["report"]},{"url":"https://bugzilla.suse.com/1269053","tags":["report"]},{"url":"https://bugzilla.suse.com/1269054","tags":["report"]},{"url":"https://bugzilla.suse.com/1269055","tags":["report"]},{"url":"https://bugzilla.suse.com/1269056","tags":["report"]},{"url":"https://bugzilla.suse.com/1269057","tags":["report"]},{"url":"https://bugzilla.suse.com/1269058","tags":["report"]},{"url":"https://bugzilla.suse.com/1269060","tags":["report"]},{"url":"https://bugzilla.suse.com/1273429","tags":["report"]},{"url":"https://bugzilla.suse.com/1273430","tags":["report"]},{"url":"https://bugzilla.suse.com/1273431","tags":["report"]},{"url":"https://bugzilla.suse.com/1273432","tags":["report"]},{"url":"https://bugzilla.suse.com/1273433","tags":["report"]},{"url":"https://bugzilla.suse.com/1273434","tags":["report"]},{"url":"https://bugzilla.suse.com/1273435","tags":["report"]},{"url":"https://bugzilla.suse.com/1273436","tags":["report"]},{"url":"https://bugzilla.suse.com/1273437","tags":["report"]},{"url":"https://bugzilla.suse.com/1273438","tags":["report"]},{"url":"https://bugzilla.suse.com/1273439","tags":["report"]},{"url":"https://bugzilla.suse.com/1273440","tags":["report"]},{"url":"https://bugzilla.suse.com/1273441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271931","tags":["report"]},{"url":"https://bugzilla.suse.com/1271932","tags":["report"]},{"url":"https://bugzilla.suse.com/1271933","tags":["report"]},{"url":"https://bugzilla.suse.com/1271934","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44510","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623323-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43618","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8283-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43618","title":"Rsync \u003c 3.4.3 Integer Overflow Information Disclosure","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T00:50:21.416Z","modified":"2026-11-08T14:03:21.937Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-190","CWE-125","CWE-190"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-31011","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T00:50:21Z","modified":"2026-11-08T14:03:21Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-08T15:13:08.77824Z"}],"ghsa":[{"id":"GHSA-88m5-cm5m-2596","title":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token...","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T03:31:33Z","modified":"2026-06-30T03:36:45Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-02T15:09:05.34707Z"}],"nvd":[{"id":"CVE-2026-43618","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T02:16:36.41Z","modified":"2026-09-01T13:19:32.533Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"ALPINE-CVE-2026-43618","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T02:16:36.41Z","modified":"2026-10-01T02:17:49.302427827Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-43618","status":"published","published":"2026-05-21T06:10:53.865636Z","modified":"2026-05-26T07:15:13.531279926Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.12174Z"},{"id":"CVE-2026-43618","title":"Rsync \u003c 3.4.3 Integer Overflow Information Disclosure","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T00:50:21.416Z","modified":"2026-11-09T02:31:04.507837736Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2026-43618","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T02:16:36.41Z","modified":"2026-10-01T03:03:23.585356293Z","cvss":[{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"JLSEC-2026-629","title":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token...","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-06-25T17:41:14.392Z","modified":"2026-07-18T00:02:16.483822673Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2502","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.337509007Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2503","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.472470437Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2504","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.517490681Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2505","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.4127594Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2550","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-06-05T11:11:29Z","modified":"2026-08-18T01:20:02.525927506Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:26332","title":"Red Hat Security Advisory: rsync security, bug fix, and enhancement update","status":"published","published":"2026-06-17T10:08:44Z","modified":"2026-10-09T10:23:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26408","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-17T10:08:48Z","modified":"2026-10-09T10:23:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:26410","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-17T10:08:49Z","modified":"2026-10-09T10:23:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RLSA-2026:26332","title":"Important: rsync security, bug fix, and enhancement update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n\n* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase rsync to version 3.4.4 in Rocky Linux10 (JIRA:Rocky Linux-181630)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-19T06:04:41.448408Z","modified":"2026-06-19T06:30:08.969156446Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:26408","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n\n* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-17T06:00:15.788686Z","modified":"2026-06-17T06:30:05.824421052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:26410","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n\n* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-17T12:03:08.073041Z","modified":"2026-06-17T12:30:06.077815028Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-43618","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-06-30T18:18:11.471183001Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":6.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"ALSA-2026:26332","title":"Important: rsync security, bug fix, and enhancement update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Rebase rsync to version 3.4.4 in AlmaLinux10 (JIRA:AlmaLinux-181630)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-29T11:30:18.733470613Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:26408","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-29T11:02:23.865606374Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:26410","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)\n  * rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-16T00:00:00Z","modified":"2026-10-29T11:32:34.078702418Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-86988","title":"CVE-2026-43618 affecting package rsync for versions less than 3.4.3-1","description":"Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.","status":"published","published":"2026-05-20T02:16:36Z","modified":"2026-08-28T17:56:47.426069Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"CLSA-2026-1779368965","title":"Fix CVE(s): CVE-2026-43618","description":"   * SECURITY UPDATE: integer overflow in compressed-token decoder\n     - debian/patches/CVE-2026-43618.patch: cap rx_token at MAX_TOKEN_INDEX\n       and reject over-long simple_recv_token literal chunks to prevent\n       remote memory disclosure via crafted compressed stream\n     - CVE-2026-43618","status":"published","published":"2026-05-21T13:09:29Z","modified":"2026-06-04T10:04:00.018653Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779369352","title":"Fix CVE(s): CVE-2026-43618","description":"   * SECURITY UPDATE: integer overflow in compressed-token decoder\n     - debian/patches/CVE-2026-43618.patch: cap rx_token at MAX_TOKEN_INDEX\n       and reject over-long simple_recv_token literal chunks to prevent\n       remote memory disclosure via crafted compressed stream\n     - CVE-2026-43618","status":"published","published":"2026-05-21T13:15:57Z","modified":"2026-06-04T10:03:30.648931Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779369622","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-21T13:20:26Z","modified":"2026-06-01T00:31:35.922594912Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779369649","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-21T13:20:54Z","modified":"2026-06-01T00:33:13.418021422Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779369849","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-21T13:24:14Z","modified":"2026-06-01T00:33:15.181420068Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779438231","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder allowing\n  memory disclosure via crafted compressed stream","status":"published","published":"2026-05-22T08:23:55Z","modified":"2026-06-01T00:32:34.348290451Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779455173","title":"Fix CVE(s): CVE-2026-43618","description":"   * SECURITY UPDATE: integer overflow in compressed-token decoder allows\n     memory disclosure to a malicious sender\n     - debian/patches/CVE-2026-43618.patch: cap rx_token at MAX_TOKEN_INDEX\n       and add overflow checks in recv_compressed_token_num/run; add\n       CHUNK_SIZE bound check in simple_recv_token; initialize data=NULL\n       per iteration and validate literal token pointer in receiver\n     - CVE-2026-43618","status":"published","published":"2026-05-22T13:06:17Z","modified":"2026-06-04T10:04:28.846378Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779466465","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-22T16:14:30Z","modified":"2026-06-01T00:32:54.647281215Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779711183","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-25T12:13:07Z","modified":"2026-10-26T09:31:57.517100555Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779711647","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-25T12:20:51Z","modified":"2026-10-26T09:31:54.462414101Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779712103","title":"rsync: Fix of CVE-2026-43618","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoder\n  allowing remote memory disclosure via crafted compressed stream","status":"published","published":"2026-05-28T14:23:48Z","modified":"2026-10-26T09:31:42.102261621Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779823985","title":"rsync: Fix of 2 CVEs","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoding that\n  could leak rsync process memory contents over the wire\n- CVE-2026-29518: fix TOCTOU race on parent path components in non-chroot\n  daemon by routing receiver/sender opens, chmod, and chdir through per-\n  component O_NOFOLLOW secure variants gated on use_secure_symlinks","status":"published","published":"2026-05-26T19:33:09Z","modified":"2026-10-26T09:43:27.036909305Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779824462","title":"rsync: Fix of 2 CVEs","description":"- CVE-2026-43618: fix integer overflow in compressed-token decoding that\n  could leak rsync process memory contents over the wire\n- CVE-2026-29518: fix TOCTOU race on parent path components in non-chroot\n  daemon by routing receiver/sender opens, chmod, and chdir through per-\n  component O_NOFOLLOW secure variants gated on use_secure_symlinks","status":"published","published":"2026-05-26T19:41:06Z","modified":"2026-10-26T09:43:30.700628116Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779869103","title":"Fix CVE(s): CVE-2024-12086, CVE-2026-29518, CVE-2026-43618","description":"   * SECURITY UPDATE: receiver process memory disclosure via compressed-token\n     integer overflow:\n     - debian/patches/els/0004-CVE-2026-43618.patch: cap rx_token at\n       MAX_TOKEN_INDEX; reject out-of-range token values.\n     - CVE-2026-43618.\n   * SECURITY UPDATE: malicious server can enumerate arbitrary client files\n     via crafted checksum responses:\n     - debian/patches/els/0005-CVE-2024-12086.patch: add secure_relative_open()\n       and route the receiver's basis-file open through it.\n     - CVE-2024-12086.\n   * SECURITY UPDATE: daemon TOCTOU symlink race on parent path components\n     when \"use chroot = no\":\n     - debian/patches/els/0006-CVE-2026-29518.patch: gate sender/receiver\n       opens and chmods through secure_relative_open() / do_chmod_at().\n     - CVE-2026-29518.","status":"published","published":"2026-05-27T08:05:13Z","modified":"2026-06-04T10:03:14.701516Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2026-0265","title":"Updated rsync package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nRsync \u003c 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File\nWrite. (CVE-2026-29518)\nRsync \u003c 3.4.3 Authorization Bypass via Hostname Resolution.\n(CVE-2026-43617)\nRsync \u003c 3.4.3 Integer Overflow Information Disclosure. (CVE-2026-43618)\nRsync \u003c 3.4.3 Symlink Race Condition via Path-Based Syscalls.\n(CVE-2026-43619)\nRsync \u003c 3.4.3 Out-of-Bounds Array Read via recv_files().\n(CVE-2026-43620)\nRsync \u003c 3.4.3 Off-by-One Stack Write via HTTP Proxy. (CVE-2026-45232)\n","status":"published","published":"2026-07-18T23:55:48Z","modified":"2026-07-19T00:00:04.314738521Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10857-1","title":"rsync-3.4.3-1.1 on GA media","description":"These are all security issues fixed in the rsync-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.511446534Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20877-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:13:41Z","modified":"2026-06-04T09:00:10.423530016Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21650-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:55Z","modified":"2026-08-27T17:30:03.680559724Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2038-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n    \n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T13:33:41Z","modified":"2026-05-22T09:00:05.164069318Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2048-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-25T13:55:42Z","modified":"2026-05-26T08:15:05.350251039Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2083-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-27T07:56:11Z","modified":"2026-05-28T08:15:05.799079873Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21726-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n\nNon security issues:\n\n- rsync --delay-updates never updates after interruption (bsc#1204538).\n- Fix duplication of flag causing illegal hashkey failures.\n","status":"published","published":"2026-05-21T11:04:19Z","modified":"2026-05-23T18:23:40.42363199Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21739-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T11:23:33Z","modified":"2026-05-23T18:23:41.730720723Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21980-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-04T09:00:07.395663315Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22015-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-09T18:24:27.804925101Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:23253-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-24T14:42:20Z","modified":"2026-08-27T18:23:12.181176422Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23289-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:35Z","modified":"2026-09-04T18:23:13.554181498Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23323-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).\n- CVE-2026-53784: Daemon module-root chdir escape under \"use chroot = no\" (bsc#1269042).\n- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).\n- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).\n- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).\n- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).\n- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).\n- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).\n- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).\n- CVE-2026-53793: Chroot \"/./\" inner-module escape via a parent-component symlink (bsc#1269051).\n- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).\n- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement\n  (bsc#1269053).\n- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).\n- CVE-2026-53797: Sender source-tree parent-component symlink race -\u003e out-of-tree disclosure (bsc#1269055).\n- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).\n- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -\u003e arbitrary ACL set (bsc#1269056).\n- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -\u003e arbitrary file deletion\n  outside the source tree (bsc#1269057).\n- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -\u003e out-of-tree disclosure\n  (bsc#1269058).\n- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).\n- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths\n  (bsc#1269040).\n- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant\n  to block (bsc#1273441).\n- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).\n- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).\n- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).\n- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs\n  (bsc#1273437).\n- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).\n- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).\n- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory\n  transfer root (bsc#1273434).\n- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-\n  module symlink (bsc#1273433).\n- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).\n- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).\n- CVE-2026-70463: \"auth users\" ignores documented comma-only parsing, silently skipping a deny/read-only rule\n  (bsc#1273430).\n- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).\n","status":"published","published":"2026-08-26T12:30:35Z","modified":"2026-09-10T18:23:10.543995859Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}