Red Hat Security AdvisoryRHSA-2026:26332
rsync security, bug fix, and enhancement update
Released 2026-06-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) rsync-daemon-3.4.4-1.el10_2, rsync-rrsync-3.4.4-1.el10_2
- Red Hat Enterprise Linux BaseOS (v. 10) rsync-3.4.4-1.el10_2
Fixes 2 records
Priority LOW 33
Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory…
CVSS 4.0HIGH 7.3· Local · Low privileges · No interaction · EPSS 0.00152 · Published 2026-05-20 · Partial fix · 3.4.3 CWE-367
Priority LOW 31
Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that c…
CVSS 4.0MEDIUM 6.1· Network · Low privileges · No interaction · EPSS 0.0078 · Published 2026-05-20 · Partial fix · 3.4.3 CWE-125
