CVE-2026-43617

The record

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Affected packages

Related vulnerabilities

• CVE-2026-29518 Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race… Also affects rsync
• CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read… Also affects rsync
• CVE-2026-43618 Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… Also affects rsync
• CVE-2026-43619 Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in… Also affects rsync
• CVE-2026-45232 Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability… Also affects rsync
• CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a… Also affects rsync
• CVE-2025-10158 A malicious client acting as the receiver of an rsync file transfer can trigger an out of… Also affects rsync
• CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. Also affects rsync