Moderate Security Vulnerability in rsync: Out of Bounds Array Access
Summary
RLSA-2026:6825: Moderate: rsync security update. Affects rsync versions < 0:3.4.1-2.el10_1.2. Fixed in 0:3.4.1-2.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. Its efficiency stems from its ability to transfer only the differences between files, rather than the entire files themselves. This makes rsync an essential tool for backup and mirroring tasks, especially in environments where bandwidth is limited. However, like any software, rsync is not immune to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-10158 involves an out-of-bounds array access due to a negative index in the rsync utility. This flaw can potentially allow an attacker to exploit the software, leading to unintended behavior or crashes. The ramifications of this vulnerability could range from denial of service to unauthorized access to sensitive data, depending on how the utility is used in various environments.
How To Fix
Minimum fixed version
0:3.4.1-2.el10_1.2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using features of rsync that may trigger the vulnerability until the package is updated. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The rsync utility has a moderate security vulnerability (CVE-2025-10158) that can lead to out-of-bounds array access. It is crucial for users to update to the patched version to mitigate potential risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for rsync →
FAQ
CVE-2025-10158 is a security vulnerability in the rsync utility that allows for out-of-bounds array access via a negative index.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include denial of service and unauthorized access to sensitive data, depending on how rsync is utilized.
You can update rsync by running the command 'sudo yum update rsync' in your terminal, which will install the fixed version 0:3.4.1-2.el10_1.2.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
