Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 58

Export CSV
CVE-2024-12087

Rsync: path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Almalinux Archlinux Gentoo and 5 more
Products
Almalinux Arch Linux Linux and 23 more
CVE-2026-43617

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-45232

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-43620

Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()

Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-43619

Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2026-43618

Rsync < 3.4.3 Integer Overflow Information Disclosure

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rsync Project Samba
Products
Rsync Rsync
CVE-2008-1720

rsync: integer overflow in xattr handling

Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 5.0% KEV · Not listed
Vendors
Samba
Products
Rsync
CVE-2002-0080

security flaw

rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Samba
Products
Linux Rsync
CVE-2017-17433

rsync: recv_files function metadata handling allows for access restriction bypass

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the daemon_filter_list data structure, which allows remote attackers to bypass intended access restrictions.

CVSS 3.0 · 3.7 Low EPSS 1.8% KEV · Not listed
Vendors
Debian Samba
Products
Debian Linux Rsync
CVE-2017-17434

rsync: daemon does not check for fnamecmp filenames allowing for access restriction bypass

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also does not apply the sanitize_paths protection mechanism to pathnames found in "xname follows" strings (in the read_ndx_and_attrs function in rsync.c), which allows remote attackers to bypass intended access restrictions.

CVSS 3.0 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Debian Samba
Products
Debian Linux Rsync
CVE-2017-16548

rsync: Heap-based buffer over-read in receive_xattr function

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact by sending crafted data to the daemon.

CVSS 3.1 · 9.8 Critical EPSS 5.8% KEV · Not listed
Vendors
Canonical Debian Samba
Products
Ubuntu Linux Debian Linux Rsync
CVE-2017-15994

rsync: Mishandles archaic checksums

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. NOTE: the rsync development branch has significant use beyond the rsync developers, e.g., the code has been copied for use in various GitHub projects.

CVSS 3.0 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Samba
Products
Rsync
CVE-2014-9512

rsync: Transferring file outside destination path via just-sent symlink

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path.

CVSS 2.0 · 6.4 Medium EPSS 6.5% KEV · Not listed
Vendors
Opensuse Oracle Samba
Products
Opensuse Solaris Rsync
CVE-2014-2855

rsync: CPU consumption denial of service when authenticating with a non-existent username

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.

CVSS 2.0 · 7.8 High EPSS 4.2% KEV · Not listed
Vendors
Samba
Products
Rsync
CVE-2011-1097

rsync: Incremental file-list corruption due to temporary file_extra_cnt increments

rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.

CVSS 2.0 · 5.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat Samba
Products
Enterprise Linux Rsync
CVE-2022-29154

rsync: remote arbitrary files write inside the directories of connecting peers

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file).

CVSS 3.1 · 7.4 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Redhat Samba
Products
Fedora Enterprise Linux Rhel E4s and 3 more
CVE-2020-14387

rsync: rsync-ssl does not verify the hostname in the server certificate when using openssl

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

CVSS 3.1 · 7.4 High EPSS 1.1% KEV · Not listed
Vendors
Samba
Products
Rsync
CVE-2018-5764

rsync: sanitization bypass in parse_argument in options.c

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism.

CVSS 3.1 · 7.5 High EPSS 6.4% KEV · Not listed
Vendors
Canonical Debian Samba
Products
Ubuntu Linux Debian Linux Rsync