Executive brief
Rsync is a widely used utility for synchronizing files between different systems. A vulnerability in the client-side software allows a malicious server to crash the rsync client during a file transfer. This could be used to disrupt automated backup or deployment processes, though it does not appear to allow for data theft or unauthorized system access.
Technical details
An out-of-bounds array read exists in the recv_files() function within receiver.c. By setting the CF_INC_RECURSE flag and providing a specially crafted file list where the first entry is not the leading dot directory, a malicious sender can cause the receiver to set an internal index (parent_ndx) to -1. When a subsequent transfer record with ndx=0 and specific flags is processed, the receiver attempts to read memory 8 bytes before the allocated pointer array. This results in a null or invalid pointer dereference and a deterministic SIGSEGV crash. The vulnerability is reachable via both rsync:// and remote-shell (SSH) pulls. A fix is available in version 3.4.3, and a workaround is to use the --no-inc-recursive flag.
Affected products
- RsyncProject rsync <= 3.4.2
Timeline
- 2026-05-19: disclosed: Vulnerability reported by Pratham Gupta.
- 2026-05-20: patched: Rsync version 3.4.3 released.
- 2026-05-20: advisory