RHSA-2026:99576: Important: rsync security update
Important: rsync security update
Other sources
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.Security Fix(es): rsync: rsync: Denial of Service via crafted checksums during delta transfer (CVE-2026-119741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1 - Upgrade
Upgrade
redhat/rsync-daemonto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1 - Upgrade
Upgrade
redhat/rsync-debuginfoto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1 - Upgrade
Upgrade
redhat/rsync-debugsourceto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1 - Upgrade
Upgrade
redhat/rsync-rrsyncto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1 - Upgrade
Upgrade
redhat/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1.aa - Upgrade
Upgrade
redhat/rsync-debuginfoto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1.aa - Upgrade
Upgrade
redhat/rsync-debugsourceto a version that resolves this vulnerability.Fixed in 3.5.0-3.el10_2.1.aa
Event History
Frequently Asked Questions
What is the practical impact of this issue?
A crafted checksum during an rsync delta transfer can cause a denial of service. Systems using rsync for file synchronization or mirroring may have their rsync operation disrupted.
Which systems should be prioritized for remediation?
Prioritize affected Red Hat systems running rsync, especially those that use it for network synchronization or mirroring. The listed affected software includes rsync and its debuginfo and debugsource packages across several Red Hat Enterprise Linux support variants.
What attacker interaction is indicated by the advisory?
The issue is triggered through crafted checksums during an rsync delta transfer. The advisory does not specify whether authentication, a particular rsync mode, or default configuration is required.