Critical Security Update for rsync: Out of Bounds Array Access Vulnerability
Summary
ALSA-2026:6390: Moderate: rsync security update. Affects rsync versions < 3.2.5-3.el9_7.2. Fixed in 3.2.5-3.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rsync is a widely used utility for copying and synchronizing files both locally and across networks. Its efficiency lies in its ability to transfer only the differences between files, making it a preferred choice for mirroring and backup tasks. However, vulnerabilities in rsync can lead to severe security risks, including unauthorized access and data corruption.
Vulnerability Detail
The vulnerability identified as CVE-2025-10158 involves an out-of-bounds array access via a negative index in the rsync utility. This flaw can be exploited by attackers to manipulate the rsync process, potentially leading to arbitrary code execution or data leakage. The issue arises from improper handling of array indices, which can result in accessing memory locations that are not allocated for the application, thereby compromising system integrity.
How To Fix
Minimum fixed version
3.2.5-3.el9_7.2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the rsync service or disable it until the update is applied. This can be done by stopping the rsync daemon with the command:
sudo systemctl stop rsyncd'.
Conclusion
The rsync utility is essential for efficient file synchronization, but the identified vulnerability (CVE-2025-10158) poses significant security risks. Users are strongly advised to update to the latest patched version to safeguard their systems. Additionally, utilizing tools like Vulert can enhance vulnerability monitoring and alerting.
See every vulnerability recorded for rsync →
FAQ
CVE-2025-10158 is a security vulnerability in the rsync utility that allows for out-of-bounds array access, potentially leading to unauthorized access or code execution.
You can check your version of rsync by running 'rsync --version' in the terminal. If it is below 3.2.5-3.el9_7.2, it is vulnerable.
If an immediate update is not possible, consider restricting access to the rsync service or disabling it temporarily to mitigate risks.
For more details, you can refer to the CVE page associated with CVE-2025-10158 or visit the AlmaLinux advisory page.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
