CVE-2026-44509: Rsync: Symlink races on path-based syscalls
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.4.3 - Configuration
For rsync daemons, do not run with use chroot = no; use a chrooted setup (i.e., set use chroot to yes or otherwise enable chroot) to prevent local filesystem access from modifying files outside the exported module
rsync daemon use chroot = no
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44509?
The severity of CVE-2026-44509 is classified as medium with a score of 6.3.
How do I fix CVE-2026-44509?
To fix CVE-2026-44509, upgrade rsync to version 3.4.3 or later.
What vulnerabilities does CVE-2026-44509 address?
CVE-2026-44509 addresses symlink races in path-based system calls such as chmod() and chown() in rsync.
Who is affected by CVE-2026-44509?
Users of rsync versions prior to 3.4.3, especially those using configured daemons with 'use chroot = no', are affected by CVE-2026-44509.
What are the potential impacts of CVE-2026-44509?
CVE-2026-44509 could allow attackers to exploit symlink races, leading to unauthorized file modifications.