Executive brief
Rsync is a widely used tool for synchronizing and copying files between computers. A vulnerability in the client-side software allows a malicious server to crash the rsync client during a file transfer. While this issue can disrupt operations and cause service outages, it is currently assessed as a crash-only bug that does not allow for data theft or unauthorized system access.
Technical details
An out-of-bounds (OOB) array read exists in the recv_files() function in rsync versions prior to 3.4.3. By manipulating the wire-protocol-level communication, a malicious sender can set the 'parent_ndx' to -1 and send a specific transfer record that bypasses existing checks. This causes the receiver to read 8 bytes before the allocated pointer array and dereference the resulting value, leading to a segmentation fault (SEGV). The vulnerability affects clients performing recursive pulls (the default behavior in protocol 30+) and can be mitigated by using the --no-inc-recursive flag or upgrading to version 3.4.3. Analysis indicates the OOB read typically lands in unmapped memory metadata, making it a crash-only vulnerability.
Affected products
- RsyncProject rsync < 3.4.3
Timeline
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD