Executive brief
Rsync is a widely used tool for synchronizing and transferring files between systems. A security flaw in the rsync daemon allows attackers to bypass certain access restrictions that are based on hostnames. If an administrator has blocked specific domains from connecting, an attacker may still be able to gain access if the system is not configured to resolve network names correctly within its restricted environment.
Technical details
A vulnerability exists in rsync versions prior to 3.4.3 when configured as a daemon using a chroot. The software performs reverse DNS lookups of connecting clients after entering the chroot environment. If the chroot lacks essential glibc resolution files (such as /etc/resolv.conf, /etc/nsswitch.conf, or NSS modules), the lookup fails and the client hostname is set to 'UNKNOWN'. This allows an attacker to bypass 'hosts deny' rules because the specific blocked hostname is never identified. Exploitation requires the attacker to control the PTR record for their source IP and for the server to be using hostname-based ACLs rather than IP-based ACLs. The issue is resolved in version 3.4.3.
Affected products
- RsyncProject rsync < 3.4.3
Timeline
- 2026-05-20: advisory: Initial GitHub advisory published
- 2026-07-20: disclosed: NVD publication date