CVE-2026-43619: Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
Last updated 2 June 2026
Other sources
Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
— Microsoft
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.2.3-4+deb11u4Fixed in 3.2.7-1+deb12u5Fixed in 3.4.1+ds1-5+deb13u3Fixed in 3.4.3+ds1-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.3 - Configuration
For rsync daemons configured with 'use chroot = no', change configuration to enable chroot (i.e., do not use 'use chroot = no') to reduce the symlink race condition impact that allows operations to be redirected outside the exported module boundary.
rsync daemon use chroot = no - Compensating control
If local filesystem access is possible, restrict local access to the rsync daemon’s filesystem/module paths (e.g., via OS permissions/ACLs or isolation) to prevent attackers from swapping symlinks during the timing window between path resolution and syscall execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43619?
CVE-2026-43619 is classified as a medium severity vulnerability due to the potential for local attackers to exploit symlink race conditions.
How do I fix CVE-2026-43619?
To fix CVE-2026-43619, upgrade Rsync to version 3.4.3 or later to mitigate the vulnerability.
What versions of Rsync are affected by CVE-2026-43619?
Rsync versions prior to 3.4.3, specifically up to and including 3.4.2, are affected by CVE-2026-43619.
What type of vulnerability is CVE-2026-43619?
CVE-2026-43619 is a symlink race condition vulnerability that affects path-based system calls in Rsync.
Who can exploit CVE-2026-43619?
CVE-2026-43619 can potentially be exploited by local attackers who have access to the system running a vulnerable version of Rsync.