Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
rsync Security Update: Unsecured Data and Privilege Escalation
published 4 months ago
Summary
rsync, a file copying and synchronization tool, has been updated to fix two security issues. One issue could allow an attacker to access sensitive data, while the other could allow an attacker to gain elevated privileges on a system. It's essential to update rsync to the latest version to prevent potential security risks.
What to do
- Update almalinux rsync to version 3.2.5-7.el9_8.2.
- Update almalinux rsync-daemon to version 3.2.5-7.el9_8.2.
- Update almalinux rsync-rrsync to version 3.2.5-7.el9_8.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:9 | almalinux | rsync |
< 3.2.5-7.el9_8.2 Fix: upgrade to 3.2.5-7.el9_8.2
|
| AlmaLinux:9 | almalinux | rsync-daemon |
< 3.2.5-7.el9_8.2 Fix: upgrade to 3.2.5-7.el9_8.2
|
| AlmaLinux:9 | almalinux | rsync-rrsync |
< 3.2.5-7.el9_8.2 Fix: upgrade to 3.2.5-7.el9_8.2
|
Original advisory text
Important: rsync security update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.
Security Fix(es):
* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618)
* rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:26410 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-29518 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-43618 Third Party Advisory
- https://bugzilla.redhat.com/2469054 Third Party Advisory
- https://bugzilla.redhat.com/2469055 Third Party Advisory
- https://errata.almalinux.org/9/ALSA-2026-26410.html Vendor Advisory
Timeline
Published16 Jun 2026
Updated18 Jun 2026
First seen18 Jun 2026
Sources
ALSA-2026:26410 · OSV
Track software like this
Free during beta