Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rsync | May 25, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rsync-daemonUpgrade rsyncUpgrade rsync-debugsourceUpgrade rsync-debuginfo | Sep 30, 2026 | May 20, 2026 |
| Debian | — | Upgrade rsync | May 24, 2026 | May 24, 2026 |
| Freebsd | — | Upgrade rsync | Jun 15, 2026 | May 21, 2026 |
| Gentoo Linux | — | Upgrade net-misc/rsync. | Aug 16, 2026 | Aug 13, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | May 20, 2026 |
| Ubuntu | — | Upgrade rsync (Ubuntu Pro)Upgrade rsync | May 25, 2026 | May 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 22, 2026 | May 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub