6.3
Medium
CVE-2026-43617 Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based…
Description
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| rsync 3.4 | earliest → < 3.4.3 | 3.4.3 |
Other CVEs of rsync
The 44 CVEs of rsync →
CVE-2026-119741
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
8.7
High
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent…
9.1
Critical
CVE-2026-70453
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote…
8.7
High
CVE-2026-70454
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation…
7.6
High