rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the readargs() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate.

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

I've released rsync 3.4.4 which has regression fixes for the rsync 3.4.3 security release. The release is available from https://rsync.samba.org/ - it is not embargoed as it contains no new security issues, just fixes for the regressions that 3.4.3 introduced. As part of the release I have created 3.2.7 and 3.4.1 backport patch sets to aid distros with LTS releases that use those versions. The backport patch sets and their signatures are on https://rsync.samba.org/. For each backport I have created two sets of patches: - one against the original release (so v3.2.7 and v3.4.1) - and another one against the last security update for easy addition to existing security releases

I would also note that there will be a 3.5.0 rsync release soon with a lot more security updates.

As part of the 3.5.0 release update I have created a rsync-security () lists samba org mailing list for anyone who is willing to do testing of the 3.5.0 release. The idea is to try to reduce the chance of more regressions by expanding the set of testers of this release. I have seeded it with people who were involved in past rsync security issues. If you want to join this list then the easiest way would be for you to be vouched for by someone on the distros () vs openwall org list or someone else I already trust.

My apologies for the regressions in the 3.4.3 release and I hope future security updates for rsync will have less issues. The greatly expanded test suite in rsync 3.5 combined with the rsync-security mailing list should help.

Andrew Tridgell rsync maintainer -----BEGIN PGP SIGNATURE----- Version: FlowCrypt Email Encryption 8.5.13 Comment: Seamlessly send and receive encrypted email

wsG5BAEBCgBtBYJqJl3lCRAbskmXqFNfb0UUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3Jn8M9+D7RakZWFVKNLrCgGw69BM3jUlgbHvrx9 KQbWSH8WIQSf7xEtzhmg3H6ILLgbskmXqFNfbwAAmAcQAJ10haM7QtOQmpq5 62x0fCA+71a8PqhTH+YICs940EnthjY8WlkxSxzEXGgPpTLWcdQrbpgZvOdr vwozmwNTSJRgfklKuWDNNttrwBa3KclaT7p3ymN5xNirU+I8yDN+Csh5CpUE eeqvZrugqNNlipwDiyGhXntuy8NtVJU4w71MNAbXcV/MU/vzZ2kGml0GRXgr d+6MXKon85mkMZJhRC48h/W90NTuc2BUKtkBVf3bYyzeqJtvS88Ar/iLA8/+ tj02z5tw/FOgGcrMU5t3KwAhiuzpXoo9uTPMim0Nupil2LiJeZNc+bHB4xKY XlPOjveylZe+HYsGerwNOgN76bBlTebXiRR03MaGPiLNdwTx4QyE+6tdaFF4 VvwCjXLHursH5tX0Q0O9OgHVzeX++TGcmUi20ozgthVbPnW43sVxEV1w+XAN oEuchE+akM0rt1qifPmwbd/qLCD7oV/784UTq8SCQ1jMOyA8emJbkRd5QLD0 VixSl7L1LRBoirWxiSQgzy5C7yFGgZB8MKa0T8eKjLi17w7WxtpwOlYuMDCS miCLP3/tUIcd9TCYMLJ0BZWQv01DUUBu90UEnZT5yu2HQ2X0gYeP8xXK3j/9 /ABuDxEHQl19UQgKG6rOgQ93JssSRqvIgIBeW3v7pn1vm2B0mnJ61gT/xtqw 5EmzaYXc =nOpH -----END PGP SIGNATURE-----

Last updated 2 June 2026

Last updated 2 June 2026

Last updated 2 June 2026

Last updated 22 May 2026

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed.

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed.

A flaw was found in rsync. An authenticated daemon peer can exploit an integer overflow vulnerability in the compressed-token decoder. By carefully manipulating the compressed-token, a malicious sender can trigger an overflow, leading to remote memory disclosure. This allows an attacker to leak sensitive process memory contents, including environment variables, passwords, and memory pointers, which significantly weakens Address Space Layout Randomization (ASLR) and can facilitate further exploitation.

A flaw was found in rsync. An authenticated daemon peer can exploit an integer overflow vulnerability in the compressed-token decoder. By carefully manipulating the compressed-token, a malicious sender can trigger an overflow, leading to remote memory disclosure. This allows an attacker to leak sensitive process memory contents, including environment variables, passwords, and memory pointers, which significantly weakens Address Space Layout Randomization (ASLR) and can facilitate further exploitation.

Salvatore Bonaccorso <carnil () debian org> writes: hi,

On Thu, Apr 16, 2026 at 08:27:56AM -0700, Alan Coopersmith wrote: On 4/15/26 22:49, Przemyslaw Frasunek wrote: 7. TIMELINE

2008-03-07  Bug introduced in commit d724dd186 (rsync 3.0.1pre1).             The commit added qsort to receivexattr() for sorting xattrs             after namespace prefix munging in --fake-super mode. 2026-04-16  This report. Have you notified the rsync maintainers about this? When? FWIW, it looks this got CVE-2026-41035 assigned: https://www.cve.org/CVERecord?id=CVE-2026-41035 -> https://github.com/RsyncProject/rsync/issues/871

Over there, tridge says: This is mostly a way for the client to shoot down their own connection to the fork-per-connection process. I need to look further into the potential impact of a malicious server, [...]

[...] sam

hi,

On Thu, Apr 16, 2026 at 08:27:56AM -0700, Alan Coopersmith wrote: On 4/15/26 22:49, Przemyslaw Frasunek wrote: 7. TIMELINE

2008-03-07  Bug introduced in commit d724dd186 (rsync 3.0.1pre1).             The commit added qsort to receivexattr() for sorting xattrs             after namespace prefix munging in --fake-super mode. 2026-04-16  This report. Have you notified the rsync maintainers about this? When? FWIW, it looks this got CVE-2026-41035 assigned: https://www.cve.org/CVERecord?id=CVE-2026-41035

Regards, Salvatore

On 4/15/26 22:49, Przemyslaw Frasunek wrote: 7. TIMELINE

2008-03-07  Bug introduced in commit d724dd186 (rsync 3.0.1pre1).             The commit added qsort to receivexattr() for sorting xattrs             after namespace prefix munging in --fake-super mode. 2026-04-16  This report. Have you notified the rsync maintainers about this? When?

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris