CVE-2026-44510

Received Received - Intake

Out-of-Bounds Read in Rsync Prior to 3.4.3

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver-side out-of-bounds array read in rsync's recv_files() lets a malicious rsync server (or any peer acting in the sender role) deterministically crash any rsync client that pulls from it. The trigger is fully wire-protocol-level, requires no special options on the victim, and works for both rsync:// URLs and remote-shell pulls; since inc_recurse is the protocol-30+ default, any client doing a normal recursive pull against an attacker-controlled URL is exposed. A malicious server sets CF_INC_RECURSE, sends a flist whose first sorted entry is not the leading "." directory (causing parent_ndx to be set to -1), then sends a transfer record with ndx = 0 and an iflag omitting ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference the result in f_name(). The impact is crash-only: the out-of-bounds read lands in glibc mmap chunk metadata and dereferences to an unmapped low address, producing a SEGV that cannot be leveraged into an exploit (confirmed on glibc x86-64 Linux; non-glibc allocators not audited). This issue is fixed in version 3.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-44510

Affected Vendors & Products

Vendor	Product	Version / Range
rsync	rsync	3.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a denial-of-service vulnerability in Rsync versions before 3.4.3. A malicious server can crash any client pulling files by sending a specially crafted file list. The crash occurs due to an out-of-bounds array read in the receiver's code, causing a segmentation fault.

Detection Guidance

This vulnerability can be detected by checking the installed version of rsync on your system. If you are running a version prior to 3.4.3, your system is vulnerable. Use the command 'rsync --version' to check the installed version.

Impact Analysis

If you use an affected Rsync version to pull files from an untrusted server, the server could crash your client application. This results in a temporary denial of service as the client process terminates unexpectedly.

Compliance Impact

This vulnerability causes a crash in rsync clients but does not lead to data exposure or manipulation, so it likely does not directly violate GDPR or HIPAA compliance requirements. However, repeated crashes could disrupt data processing workflows, potentially impacting availability obligations under these regulations.

Mitigation Strategies

Immediately upgrade rsync to version 3.4.3 or later. This can typically be done using your system's package manager, such as 'apt upgrade rsync' for Debian-based systems or 'yum update rsync' for RHEL-based systems.

Hi! I’m here to help you understand CVE-2026-44510. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70