Critical Security Update for rsync: Remote Memory Disclosure and Privilege Escalation Vulnerabilities
Summary
ALSA-2026:26408: Important: rsync security update. Affects rsync versions < 3.1.3-27.el8_10. Fixed in 3.1.3-27.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rsync is a widely used utility for copying and synchronizing files both locally and across networks. It is known for its efficiency, as it only transfers the differences between files rather than the entire file, making it a preferred choice for mirroring and backup tasks. However, vulnerabilities in rsync can lead to serious security risks, including unauthorized access and data exposure.
Vulnerability Detail
The vulnerabilities identified in rsync include a remote memory disclosure issue due to an integer overflow in compressed-token decoding (CVE-2026-43618) and a TOCTOU symlink race condition that allows local privilege escalation in daemon mode without chroot (CVE-2026-29518). These vulnerabilities can potentially allow attackers to gain unauthorized access to sensitive information or escalate their privileges on the system, leading to further exploitation.
How To Fix
Minimum fixed version
3.1.3-27.el8_10
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the rsync daemon mode or implementing strict access controls to limit exposure until the package can be updated.
Conclusion
The vulnerabilities in rsync pose significant security risks that can lead to unauthorized access and data exposure. It is crucial to update to the patched version as soon as possible to mitigate these risks. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for rsync →
FAQ
rsync is a utility for efficiently transferring and synchronizing files across systems, known for its speed and ability to only send differences in files.
The vulnerabilities can lead to remote memory disclosure and local privilege escalation, potentially allowing unauthorized access to sensitive data and system control.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling the rsync daemon mode or applying strict access controls as a temporary measure.
For more details, refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
