Moderate Security Vulnerability in rsync Package: Out of Bounds Array Access
Summary
ALSA-2026:6825: Moderate: rsync security update. Affects rsync versions < 3.4.1-2.el10_1.2. Fixed in 3.4.1-2.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. It is known for its efficiency, as it only transfers the differences between files rather than the entire file, making it a popular choice for backups and mirroring. However, a recent security issue has been identified that affects the rsync package, specifically versions prior to 3.4.1-2.el10_1.2, which could lead to serious security implications.
Vulnerability Detail
The vulnerability identified as CVE-2025-10158 involves an out-of-bounds array access via a negative index in the rsync utility. This flaw can potentially allow an attacker to exploit the vulnerability to execute arbitrary code or cause a denial of service. The issue arises from improper handling of array indices, which can lead to unexpected behavior and security breaches.
How To Fix
Minimum fixed version
3.4.1-2.el10_1.2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of the rsync service by restricting access to trusted networks and disabling any unnecessary features until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The rsync utility has a moderate security vulnerability that can be exploited through out-of-bounds array access. It is crucial for users to update to the latest patched version to mitigate potential risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for rsync →
FAQ
The vulnerability is an out-of-bounds array access that can be exploited via a negative index, potentially leading to arbitrary code execution or denial of service.
You can check your version of rsync by running the command 'rsync --version' in your terminal. If it is below 3.4.1-2.el10_1.2, it is affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
If you cannot update immediately, consider restricting access to the rsync service and disabling any unnecessary features as a temporary measure.
More information can be found on the CVE page for CVE-2025-10158, which details the security issue and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
