Critical Security Update for rsync: Remote Memory Disclosure and Privilege Escalation Vulnerabilities
Summary
ALSA-2026:26410: Important: rsync security update. Affects rsync versions < 3.2.5-7.el9_8.2. Fixed in 3.2.5-7.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and over networks. It is known for its efficiency, as it only transfers the differences between files, making it ideal for mirroring and backup tasks. However, recent vulnerabilities have been identified that could compromise the security of systems using rsync, particularly in daemon mode.
Vulnerability Detail
This vulnerability arises from two critical issues in the rsync utility. The first is a remote memory disclosure vulnerability caused by an integer overflow during compressed-token decoding (CVE-2026-43618). This flaw could allow attackers to access sensitive information from the memory of the rsync process. The second issue is a Time-of-Check to Time-of-Use (TOCTOU) symlink race condition that permits local privilege escalation when rsync is running in daemon mode without chroot (CVE-2026-29518). Both vulnerabilities pose significant risks, potentially allowing unauthorized access and control over affected systems.
How To Fix
Minimum fixed version
3.2.5-7.el9_8.2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the rsync daemon mode or restrict access to the rsync service until the update is applied. This can be done by modifying the rsync configuration to limit user permissions or by stopping the rsync service altogether.
Conclusion
The vulnerabilities in rsync present significant security risks that require immediate attention. Users are strongly advised to update to the latest patched version to protect their systems from potential exploitation. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for rsync →
FAQ
Rsync is a utility for efficiently transferring and synchronizing files across computer systems, using a delta transfer algorithm to minimize data transfer.
The vulnerabilities could lead to unauthorized access to sensitive data and local privilege escalation, allowing attackers to gain higher-level access to the system.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
Yes, you can disable the rsync daemon mode or restrict access to the rsync service as a temporary measure until the patch is applied.
Detailed information can be found on the CVE pages for CVE-2026-29518 and CVE-2026-43618, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.