Critical Security Update for rsync: Remote Memory Disclosure and Privilege Escalation Vulnerabilities
Summary
ALSA-2026:26332: Important: rsync security, bug fix, and enhancement update. Affects rsync versions < 3.4.4-1.el10_2. Fixed in 3.4.4-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. Its efficiency stems from its ability to transfer only the differences between files, rather than the entire file, making it a popular choice for backups and mirroring. However, recent vulnerabilities have been identified that could potentially compromise system security.
Vulnerability Detail
This vulnerability arises from two critical issues in the rsync utility. The first is a remote memory disclosure vulnerability caused by an integer overflow during compressed-token decoding (CVE-2026-43618). This flaw could allow an attacker to access sensitive information from the memory of the rsync process. The second issue is a Time-of-Check to Time-of-Use (TOCTOU) symlink race condition that permits local privilege escalation in daemon mode without chroot (CVE-2026-29518). This could enable unauthorized users to gain elevated privileges on the system, leading to potential system compromise.
How To Fix
Minimum fixed version
3.4.4-1.el10_2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the rsync daemon mode or restrict access to the rsync service until the package is updated. This can be done by modifying the rsync configuration file to limit access or by stopping the rsync service entirely.
Conclusion
The vulnerabilities in rsync pose significant risks, including potential unauthorized access and privilege escalation. It is crucial for users to update to the latest patched version to mitigate these risks. Regular monitoring and updates are essential to maintain system security.
See every vulnerability recorded for rsync →
FAQ
rsync is a utility for efficiently transferring and synchronizing files across systems by sending only the differences between files.
The vulnerabilities include a remote memory disclosure via integer overflow and a TOCTOU symlink race condition that allows local privilege escalation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
As a temporary measure, consider disabling the rsync daemon mode or restricting access to the rsync service until an update can be applied.
For detailed information, refer to the CVE pages associated with CVE-2026-29518 and CVE-2026-43618.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
