Skip to content
OpenAdvisories
High ELSA-2026-26332 2 CVEs

Important: rsync security, bug fix, and enhancement update (Oracle Linux 10)

Published Jul 16, 2026 · Updated Jul 16, 2026

Ecosystem: Oracle Linux

Summary

[3.4.4-1]
- Resolves: RHEL-181630 - Rebase rsync to version 3.4.4
- Resolves: RHEL-174929 - TOCTOU symlink race condition (CVE-2026-29518)
- Resolves: RHEL-174949 - Memory disclosure via int overflow (CVE-2026-43618)

[3.4.1-3]
- Resolves: RHEL-118549 - Do not clear DISPLAY unconditionally

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 10 rsync 0:3.4.4-1.el10_2
Oracle Linux · 10 rsync-daemon 0:3.4.4-1.el10_2
Oracle Linux · 10 rsync-rrsync 0:3.4.4-1.el10_2

Vulnerabilities 2

  • High 8.1
    CVE-2026-43618

    Rsync < 3.4.3 Integer Overflow Information Disclosure

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2026-29518

    Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

    Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attacke…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine