Critical Security Update for rsync: Addressing File Leakage and Use-After-Free Vulnerabilities
Summary
ALSA-2026:19368: Important: rsync security update. Affects rsync versions < 3.2.5-7.el9_8. Fixed in 3.2.5-7.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. Its efficiency stems from its ability to transfer only the differences between files, making it an essential tool for backups and mirroring. However, recent vulnerabilities have been identified that could compromise the security of systems using rsync.
Vulnerability Detail
The vulnerabilities in rsync include a file leakage issue where the rsync server can unintentionally expose arbitrary client files (CVE-2024-12086) and a use-after-free vulnerability in the handling of extended attributes (CVE-2026-41035). These vulnerabilities can lead to unauthorized access to sensitive files and potential system instability, posing significant risks to data integrity and security.
How To Fix
Minimum fixed version
3.2.5-7.el9_8
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the rsync server by configuring firewall rules to limit connections to trusted IP addresses until the package is updated.
Conclusion
The identified vulnerabilities in rsync pose significant risks to data security and system integrity. It is crucial for users to update their rsync installations to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in open-source software.
See every vulnerability recorded for rsync →
FAQ
rsync is a utility for efficiently transferring and synchronizing files between a local and a remote system.
The vulnerabilities include a file leakage issue and a use-after-free vulnerability in extended attribute handling.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
Implement firewall rules to restrict access to the rsync server as a temporary measure until you can apply the update.
For detailed information, refer to the CVE pages: CVE-2024-12086 and CVE-2026-41035.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
