Description
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsync | 3.0.8 | — |
| Debian 13 | rsync | 3.0.8 | — |
| Debian 12 | rsync | 3.0.8 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | rsync | 3.0.6-5.el6_0.1 | RHSA-2011:0390 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rsync | 3.1.2-1.5 | openSUSE-SU-2024:10548-1 |
Advisories 2
- RHSA-2011:0390 Red Hat Security Advisory: rsync security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10548-1 rsync-3.1.2-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 44088 third-party-advisory
- FEDORA-2011-4413 vendor-advisory
- HPSBMU02752 vendor-advisory
- [rsync] 20110122 rsync -rcv printing out filenames when content identical mailing-list
- SUSE-SR:2011:009 vendor-advisory
- RHSA-2011:0390 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=675036
- 44071 third-party-advisory
- MDVSA-2011:066 vendor-advisory
- FEDORA-2011-4427 vendor-advisory
- FEDORA-2011-4389 vendor-advisory
- ADV-2011-0793 vdb-entry
- https://bugzilla.samba.org/show_bug.cgi?id=7936
- ADV-2011-0876 vdb-entry
- ADV-2011-0873 vdb-entry
- ADV-2011-0792 vdb-entry
- http://rsync.samba.org/ftp/rsync/src/rsync-3.0.8-NEWS
- http://gitweb.samba.org/?p=rsync.git%3Ba=commit%3Bh=83b94efa6b60a3ff5eee4c5f7812c617a90a03f6
- 1025256 vdb-entry