CVE-2026-44507

Received Received - Intake

Reverse DNS Bypass in Rsync via Missing Chroot Resolver Files

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, NSS service modules), the lookup failed and the connecting hostname was set to "UNKNOWN". Hostname-based deny rules ("hosts deny = *.evil.example") therefore could not match, and an attacker who controlled the PTR record for their source IP could connect from a hostname that the administrator had intended to deny. IP-based ACLs ("hosts allow = 10.0.0.0/8") are unaffected. This issue is fixed in version 3.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-44507

Affected Vendors & Products

Vendor	Product	Version / Range
rsync	rsync	3.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Rsync before version 3.4.3 has a flaw where reverse DNS lookups for connecting clients are performed after entering a chroot environment. If the chroot lacks necessary files for DNS resolution, the lookup fails and the client hostname is set to UNKNOWN. This bypasses hostname-based deny rules in the daemon configuration.

Detection Guidance

Check the rsync version on your system with 'rsync --version'. If it is below 3.4.3, the system is vulnerable. Examine rsync daemon configuration files for chroot settings and verify if reverse DNS lookups are performed after chroot. Monitor logs for connections with hostname 'UNKNOWN' when using hostname-based deny rules.

Impact Analysis

Attackers can bypass intended access restrictions by controlling their source IP's PTR record. Hostname-based allow/deny rules become ineffective, potentially allowing unauthorized access to rsync daemon services. IP-based rules remain unaffected.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized access to systems if hostname-based deny rules are bypassed. Attackers could exploit PTR record manipulation to evade access controls, potentially leading to data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade rsync to version 3.4.3 or later. If upgrading is not immediately possible, disable hostname-based deny rules and rely solely on IP-based ACLs. Ensure the chroot environment contains necessary files for DNS resolution (/etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts).

Hi! I’m here to help you understand CVE-2026-44507. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70