Skip to content
OpenAdvisories
High RHSA-2026:26408 2 CVEs

Red Hat Security Advisory: rsync security update

Published Jun 17, 2026 · Updated Oct 9, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos rsync 0:3.1.3-27.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos rsync-daemon 0:3.1.3-27.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos rsync-debuginfo 0:3.1.3-27.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos rsync-debugsource 0:3.1.3-27.el8_10

Vulnerabilities 2

  • High 8.1
    CVE-2026-43618

    Rsync < 3.4.3 Integer Overflow Information Disclosure

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and …

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • High 7.0
    CVE-2026-29518

    Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

    Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attacke…

    RsyncProject rsync rsync rsync Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469054
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2469055
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26408.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-29518
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-29518
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-29518
  • report
    https://access.redhat.com/security/cve/CVE-2026-43618
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-43618
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-43618