This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] rsync fixes 6 vulnerabilities

rsync version 3.4.3 fixes 6 vulnerabilities affecting both the client and the server side [1], the most severe of which are described below. Red Hat systems do not offer a fix yet [2][3][4][5][6][7], Debian has provided fixes (except for CVE-2026-45232 [8]) for all security releases [9][10][11][12][13]. Ubuntu fixes all vulnerabilities in the resolute, questing, noble and jammy releases [14][15][16][17][18][19] and all except the one mentioned above [14] also in the focal, bionic, xenial and trusty releases. Gentoo has an update available for the most common architectures [20]. Individual OS releases and their fixed versions: Debian [9][10][11][12][13]: bullseye (security) - 3.2.3-4+deb11u4 bookworm (security) - 3.2.7-1+deb12u5 trixie (security) - 3.4.1+ds1-5+deb13u3 forky, sid - 3.4.3+ds1-2 Ubuntu [14][15][16][17][18][19]: resolute - 3.4.1+ds1-7ubuntu0.2 questing - 3.4.1+ds1-5ubuntu1.2 noble - 3.2.7-1ubuntu1.4 jammy - 3.2.7-0ubuntu0.22.04.6 focal - 3.1.3-8ubuntu0.9+esm1 bionic - 3.1.2-2.1ubuntu1.6+esm3 xenial - 3.1.1-3ubuntu1.3+esm5 trusty - 3.1.0-2ubuntu0.4+esm3 Gentoo [20] - 3.4.3

rsync - information disclosure (CVE-2026-43618)
CVSS 8.1 (High)

An authenticated remote attacker (in the daemon peer role) can, due to an integer overflow, by sending specially crafted compressed data, read sensitive data beyond the allocated memory (environment variables, passwords, heap and stack data, or memory pointers), which weakens Address Space Layout Randomization (ASLR) protection and facilitates further exploitation. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated by disabling compression on the rsync daemon by adding the 'refuse options = compress' parameter to the rsyncd.conf file. A service restart is required for the changes to take effect, and the measure may affect data transfer speed [2].

The vulnerability is present in product:

  • rsync; <3.4.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

More information:

The vulnerability was publicly disclosed 19. 5. 2026.

rsync - privilege escalation (CVE-2026-29518)
CVSS 7.8 (High)

An authenticated local attacker with write access to an rsync module can, due to a TOCTOU race condition, redirect reads and writes outside the designated module and escalate their own privileges to the elevated privileges of the daemon. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated by configuring 'use chroot = yes' in the rsyncd.conf file (the default setting, which prevents the attack), and a restart of the rsync service is required.

The vulnerability is present in product:

  • rsync; <3.4.3;

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 19. 5. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 3. 6. 2026.

CESNET, z.s.p.o. Logo