6.9
Moyenne
CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in…
Description
Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| rsync 3.4 | premières → < 3.4.3 | 3.4.3 |
Autres CVE de rsync
Les 44 CVE de rsync →
CVE-2026-119741
rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
8.7
Élevée
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent…
9.1
Critique
CVE-2026-70453
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote…
8.7
Élevée
CVE-2026-70454
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation…
7.6
Élevée