Moderate Security Vulnerability in rsync Package: Out of Bounds Array Access
Summary
ALSA-2026:6436: Moderate: rsync security update. Affects rsync versions < 3.1.3-24.el8_10. Fixed in 3.1.3-24.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and over a network. It is known for its efficiency, as it only transfers the differences between files rather than the entire files, making it a popular choice for backups and mirroring. However, a recent security issue has been identified that affects the rsync package, specifically in versions prior to 3.1.3-24.el8_10.
Vulnerability Detail
The vulnerability, identified as CVE-2025-10158, involves an out of bounds array access via a negative index in the rsync utility. This flaw can potentially allow an attacker to exploit the vulnerability, leading to unexpected behavior or crashes in the application. The issue arises from improper handling of array indices, which could be manipulated to access memory locations that are not intended, posing a risk to system stability and security.
How To Fix
Minimum fixed version
3.1.3-24.el8_10
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using features of rsync that may trigger the vulnerability until the package is updated. However, the best course of action is to apply the update as soon as possible.
Conclusion
The rsync utility has a moderate security vulnerability (CVE-2025-10158) that can lead to out of bounds array access. It is crucial to update to the patched version 3.1.3-24.el8_10 to mitigate risks associated with this vulnerability. Users are encouraged to monitor their software for vulnerabilities using tools like Vulert.
See every vulnerability recorded for rsync →
FAQ
CVE-2025-10158 is a security vulnerability in the rsync utility that allows for out of bounds array access via negative index, potentially leading to system instability.
You can check your version of rsync by running 'rsync --version' in your terminal. If it is below 3.1.3-24.el8_10, it is affected.
The risks include potential crashes of the rsync utility and possible exploitation by attackers to gain unauthorized access or disrupt services.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without any signup at the Vulert playground.
If you cannot update immediately, avoid using features that may trigger the vulnerability and plan to update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
