Skip to content
OpenAdvisories
High RHSA-2026:26332 2 CVEs

Red Hat Security Advisory: rsync security, bug fix, and enhancement update

Published Jun 17, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 rsync 0:3.4.4-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rsync-daemon 0:3.4.4-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rsync-debuginfo 0:3.4.4-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rsync-debugsource 0:3.4.4-1.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 rsync-rrsync 0:3.4.4-1.el10_2

Vulnerabilities 2

  • High 8.1
    CVE-2026-43618

    Rsync < 3.4.3 Integer Overflow Information Disclosure

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2026-29518

    Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

    Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attacke…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469054
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469055
  • article
    https://issues.redhat.com/browse/RHEL-181630
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26332.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-29518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-29518
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-29518
  • report
    https://access.redhat.com/security/cve/CVE-2026-43618
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43618
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43618