rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion

rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parsesizearg()

rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry

rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.

rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent aclsetfile() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files.

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

There will be a security release for Samba on Tuesday.

I will reply with details after that.

Douglas

-------- Forwarded Message -------- Subject: Heads-up: Upcoming important Samba security releases on 2026-07-28 Date: Mon, 20 Jul 2026 18:15:15 +0200 From: Björn Jacke via samba-technical <samba-technical () lists samba org> Reply-To: Björn Jacke <bjacke () samba org> Hi,

this is a heads-up that there will be important Samba security updates for 4.22, 4.23 and 4.24 on 2026-07-28 at 10:00 UTC.

The highest CVS score will be 8.8.

Please make sure that your Samba servers will be updated soon after the release!

Cheers Björn -- Björn Jacke Release Manager Samba Team samba.org

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

A flaw was found in samba's pamwinbind module. When pamwinbind.conf sets mkhomedir = yes, the module's pammkhomedir()/pamchownhomedir() functions call chown() on the target account's home directory (pwdir, taken directly from getpwnam()) without validating that the path is not a sensitive system directory. On RHEL, several stock system accounts (e.g. nobody, sssd, nscd) ship with / as their home directory by default in /etc/passwd. Opening a PAM session for such an account causes the root filesystem (/) to be chown'd to that account's uid/gid, breaking ownership checks relied on by sshd (StrictModes), sudo, and package tooling. Reproduced directly in an isolated sandbox using the exact affected NVRs: the trigger is not limited to root explicitly running su - nobody (the originally reported PoC) -- a non-root user holding only a narrow, common sudo delegation (e.g. 'someuser ALL=(nobody) NOPASSWD: ...') reaches the identical code path via the shared system-auth PAM stack included by sudo. Also confirmed: / ships with mode 0555 on RHEL, so the resulting ownership change does not grant the new owner write access to / (no arbitrary file creation/rename/deletion capability is gained); impact is denial of service via broken ownership checks, not privilege escalation via filesystem write access. Per the reporting bug (RHEL-178261), this was discovered during a customer penetration test (SFDC case 04452638). This flaw affects samba versions using the older pamchownhomedir() structure (samba 4.19.x/4.23.x, confirmed via source diff and live reproduction). A fix is gated and confirmed queued for RHEL 8.10.z (RHEL-178261, via RHBA-2026:169544, publishing 2026-07-28), RHEL 9.8.z (RHEL-180756, via RHBA-2026:168497, publishing 2026-08-04), and RHEL 10.2.z (RHEL-180758, via RHBA-2026:168496, publishing 2026-08-04) -- all three are non-security bug-fix errata. RHEL 9.9 and RHEL 10.3 ship samba 4.24.3, which refactored the affected code path upstream (chown() only fires when mkdir() creates a genuinely new directory, not when the target already exists) -- confirmed via live reproduction in isolated sandboxes using the exact NVRs those releases ship (samba-winbind-4.24.3-1.el9 and samba-winbind-4.24.3-100.el10) that neither su nor sudo-delegation triggers the chown. RHEL 9.9/10.3 are NOT AFFECTED.

A flaw was found in samba's pamwinbind module. When pamwinbind.conf sets mkhomedir = yes, the module's pammkhomedir()/pamchownhomedir() functions call chown() on the target account's home directory (pwdir, taken directly from getpwnam()) without validating that the path is not a sensitive system directory. On RHEL, several stock system accounts (e.g. nobody, sssd, nscd) ship with / as their home directory by default in /etc/passwd. Opening a PAM session for such an account causes the root filesystem (/) to be chown'd to that account's uid/gid, breaking ownership checks relied on by sshd (StrictModes), sudo, and package tooling. Reproduced directly in an isolated sandbox using the exact affected NVRs: the trigger is not limited to root explicitly running su - nobody (the originally reported PoC) -- a non-root user holding only a narrow, common sudo delegation (e.g. 'someuser ALL=(nobody) NOPASSWD: ...') reaches the identical code path via the shared system-auth PAM stack included by sudo. Also confirmed: / ships with mode 0555 on RHEL, so the resulting ownership change does not grant the new owner write access to / (no arbitrary file creation/rename/deletion capability is gained); impact is denial of service via broken ownership checks, not privilege escalation via filesystem write access. Per the reporting bug (RHEL-178261), this was discovered during a customer penetration test (SFDC case 04452638). This flaw affects samba versions using the older pamchownhomedir() structure (samba 4.19.x/4.23.x, confirmed via source diff and live reproduction). A fix is gated and confirmed queued for RHEL 8.10.z (RHEL-178261, via RHBA-2026:169544, publishing 2026-07-28), RHEL 9.8.z (RHEL-180756, via RHBA-2026:168497, publishing 2026-08-04), and RHEL 10.2.z (RHEL-180758, via RHBA-2026:168496, publishing 2026-08-04) -- all three are non-security bug-fix errata. RHEL 9.9 and RHEL 10.3 ship samba 4.24.3, which refactored the affected code path upstream (chown() only fires when mkdir() creates a genuinely new directory, not when the target already exists) -- confirmed via live reproduction in isolated sandboxes using the exact NVRs those releases ship (samba-winbind-4.24.3-1.el9 and samba-winbind-4.24.3-100.el10) that neither su nor sudo-delegation triggers the chown. RHEL 9.9/10.3 are NOT AFFECTED.

The WINS server component of the Active Directory Domain controller code in Samba is vulnerable to a NULL pointer dereference and crash caused by a unauthenticated UDP packet.

-------- Forwarded Message -------- Date: Tue, 26 May 2026 14:29:50 +0200 Reply-To: Stefan Metzmacher <metze () samba org> Release Announcements ---------------------

This is a security release in order to address the following defects:

o CVE-2026-1933: Missing access checks on reparse point operations

On a share marked "read only = yes" and on file handles opened R/O users can set or delete the reparse point xattrs on files that the user has write-access in the file system for.

https://www.samba.org/samba/security/CVE-2026-1933.html

o CVE-2026-2340: WORM vfs module does not block overwrites

The WORM (Write-Once, Read Many) vfs module is supposed to lock write access to shared files, so they cannot be altered after initial writes. It was allowing files to be overwritten by renaming a newly created file over a protected file.

https://www.samba.org/samba/security/CVE-2026-2340.html

o CVE-2026-3012: auto-enrolment GPO installing CA certificate over http without verification

To bootstrap a certificate chain a domain member must fetch a certificate without TLS. It was trusting HTTP for this when a more secure encrypted LDAP channel was also available.

https://www.samba.org/samba/security/CVE-2026-3012.html

o CVE-2026-3238: Denial of service against AD DC WINS server

The WINS server component of the Active Directory Domain controller code in Samba is vulnerable to a NULL pointer dereference and crash caused by a unauthenticated UDP packet.

https://www.samba.org/samba/security/CVE-2026-3238.html server "check password script" that has the %u substitution character are vulnerable to a remote code execution.

https://www.samba.org/samba/security/CVE-2026-4408.html

o CVE-2026-4480: Unauthenticated Remote Code Execution in Samba printing subsystem

Samba print servers with a "print command" that has the %J substitution character are vulnerable to a Remote Code Execution.

https://www.samba.org/samba/security/CVE-2026-4480.html

Changes -------

o Douglas Bagnall <douglas.bagnall () catalyst net nz> BUG 15997: CVE-2026-2340 BUG 16003: CVE-2026-3012 BUG 16033: CVE-2026-4480 BUG 16034: CVE-2026-4408

o Pavel Kohout <pavel () aisle com> BUG 15997: CVE-2026-2340

o Volker Lendecke <vl () samba org> BUG 15992: CVE-2026-1933 BUG 16012: CVE-2026-3238

o Stefan Metzmacher <metze () samba org> BUG 15992: CVE-2026-1933 BUG 16033: CVE-2026-4480 BUG 16034: CVE-2026-4408 has Homedir / In passwd

####################################### Reporting bugs & Development Discussion #######################################

Please discuss this release on the samba-technical mailing list or by joining the #samba-technical:matrix.org matrix room, or #samba-technical IRC channel on irc.libera.chat.

If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/).

====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================

================ Download Details ================

The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:

https://download.samba.org/pub/samba/stable/

The release notes are available online at:

https://www.samba.org/samba/history/samba-4.24.3.html https://www.samba.org/samba/history/samba-4.23.8.html https://www.samba.org/samba/history/samba-4.22.10.html

Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/)

--Enjoy The Samba Team

Last updated 2 June 2026

Last updated 2 June 2026

Last updated 2 June 2026

Last updated 22 May 2026

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.

Samba file servers and classic (non-AD) domain controllers offer the SamValidatePasswordChange and SamValidatePasswordReset RPC services on the SAMR DCE/RPC service when running over NCACNIPTCP. Both services pass a username and password to the "check password script" that can be configured in smb.conf.

If the "check password script" is configured with the %u substitution character, the client-controlled username is passed to the "check password script" without escaping shell meta-characters, leading to a remote command execution vulnerability.

This is a non-standard configuration in several ways:

It affects Samba file servers and classic (non-AD) domain controllers that have the "check password script" configured with the %u substitution character. Active Directory Domain Controllers are not affected, they do not expand the username via the %u substitution character.

The problem is much less dangerous if %u has single quotes directly around it, e.g. '%u', but it's still possible to inject command line options.

Standard Samba file servers and classic domain controllers are also only affected if the samba-dcerpcd service is started as a system service, which can only happen if "rpc start on demand helpers" is set to the non-default setting "no". In the default configuration for DCE/RPC, smbd starts the samba-dcerpcd in a way that makes the vulnerable code inaccessible.

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open(), redirecting reads (basis-file disclosure) and writes (file overwrite) outside the module. Under elevated daemon privilege this allows privilege escalation. Default "use chroot = yes" is not exposed.