CVE-2026-43617: Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
Last updated 2 June 2026
Other sources
Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
— Microsoft
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u4Fixed in 3.2.7-1+deb12u5Fixed in 3.4.1+ds1-5+deb13u3Fixed in 3.4.3+ds1-2 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.4.3 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Patch CVE-2026-29518 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Patch CVE-2026-43617 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Patch CVE-2026-43618 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Patch CVE-2026-43619 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Patch CVE-2026-43620 - Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Patch CVE-2026-45232
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43617?
CVE-2026-43617 is considered to be a medium severity vulnerability due to its potential for unauthorized access.
How do I fix CVE-2026-43617?
To fix CVE-2026-43617, upgrade rsync to version 3.4.3 or later.
What systems are affected by CVE-2026-43617?
CVE-2026-43617 affects rsync versions prior to 3.4.3, specifically the rsync daemon configured with chroot.
What is the impact of CVE-2026-43617?
The impact of CVE-2026-43617 is that attackers can bypass hostname-based deny rules, leading to potential unauthorized access.
Is CVE-2026-43617 being actively exploited?
As of the latest information, there is no public evidence indicating that CVE-2026-43617 is actively being exploited.