Executive brief
Rsync is a widely used utility for efficiently transferring and synchronizing files between systems. A security flaw in its data compression component allows a remote attacker to trick the system into leaking sensitive information from its memory. This could result in the exposure of passwords, environment variables, and other internal data, which could be used to bypass security protections or gain further access to the server.
Technical details
An integer overflow vulnerability exists in the rsync receiver's compressed-token decoder. The component uses a 32-bit signed counter to accumulate tokens without performing overflow checks. A malicious sender can provide crafted input to trigger this overflow, leading to an out-of-bounds read (CWE-125). An authenticated attacker can exploit this to leak process memory, including heap and stack data, environment variables, and library pointers. This information disclosure can be used to defeat ASLR or extract credentials. The vulnerability is fixed in version 3.4.3; a known workaround is to disable compression by setting 'refuse options = compress' in the rsyncd.conf configuration.
Affected products
- RsyncProject rsync <= 3.4.2
Timeline
- 2026-05-19: disclosed: Initial disclosure by VulnCheck
- 2026-05-20: patched: Rsync version 3.4.3 released
- 2026-05-20: advisory: GitHub Security Advisory published