# RsyncProject Rsync vulnerabilities Source: https://junglewise.ai/threats/technologies/rsync Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/rsync.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in RsyncProject Rsync: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119741, was published on 3 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 11 (0 critical, 0 exploited in the wild) ## About RsyncProject Rsync rsync is an open source utility that provides fast incremental file transfer. ## Latest RsyncProject Rsync vulnerabilities - [CVE-2026-119741: rsync denial of service in hash_search()](https://junglewise.ai/threats/cve-2026-119741-rsync-through-3-5-1-contains-a-denial-of-service-vulnerability) (high, CVSS 7.5, published 3 Nov 2026) - [CVE-2026-44510: Rsync out-of-bounds read in recv_files](https://junglewise.ai/threats/cve-2026-44510-rsync-out-of-bounds-read-in-recv-files) (medium, CVSS 6.5, published 20 Jul 2026) - [CVE-2026-44509: RsyncProject rsync symlink race in path-based syscalls](https://junglewise.ai/threats/cve-2026-44509-rsyncproject-rsync-symlink-race-in-path-based-syscalls) (medium, CVSS 6.3, published 20 Jul 2026) - [CVE-2026-44508: Rsync integer overflow in compressed-token decoder](https://junglewise.ai/threats/cve-2026-44508-rsync-integer-overflow-in-compressed-token-decoder) (high, CVSS 8.1, published 20 Jul 2026) - [CVE-2026-44507: Rsync hostname ACL bypass in chroot daemon mode](https://junglewise.ai/threats/cve-2026-44507-rsync-hostname-acl-bypass-in-chroot-daemon-mode) (medium, CVSS 4.8, published 20 Jul 2026) - [CVE-2026-29518: Rsync TOCTOU race condition in daemon file handling](https://junglewise.ai/threats/cve-2026-29518-rsync-toctou-race-condition-in-daemon-file-handling) (high, CVSS 7, published 20 May 2026) - [CVE-2026-45232: Rsync off-by-one stack write in establish_proxy_connection](https://junglewise.ai/threats/cve-2026-45232-rsync-off-by-one-stack-write-in-establish-proxy-connection) (low, CVSS 3.1, published 20 May 2026) - [CVE-2026-43620: Rsync out-of-bounds array read in recv_files](https://junglewise.ai/threats/cve-2026-43620-rsync-out-of-bounds-array-read-in-recv-files) (medium, CVSS 6.5, published 20 May 2026) - [CVE-2026-43619: Rsync symlink race condition in path-based system calls](https://junglewise.ai/threats/cve-2026-43619-rsync-symlink-race-condition-in-path-based-system-calls) (medium, CVSS 6.3, published 20 May 2026) - [CVE-2026-43618: Rsync integer overflow in compressed-token decoder](https://junglewise.ai/threats/cve-2026-43618-rsync-integer-overflow-in-compressed-token-decoder) (high, CVSS 8.1, published 20 May 2026) - [CVE-2026-43617: Rsync authorization bypass in hostname-based ACLs](https://junglewise.ai/threats/cve-2026-43617-rsync-authorization-bypass-in-hostname-based-acls) (medium, CVSS 4.8, published 20 May 2026) ## Most severe RsyncProject Rsync vulnerabilities - [CVE-2026-44508: Rsync integer overflow in compressed-token decoder](https://junglewise.ai/threats/cve-2026-44508-rsync-integer-overflow-in-compressed-token-decoder) (high, CVSS 8.1, published 20 Jul 2026) - [CVE-2026-43618: Rsync integer overflow in compressed-token decoder](https://junglewise.ai/threats/cve-2026-43618-rsync-integer-overflow-in-compressed-token-decoder) (high, CVSS 8.1, published 20 May 2026) - [CVE-2026-119741: rsync denial of service in hash_search()](https://junglewise.ai/threats/cve-2026-119741-rsync-through-3-5-1-contains-a-denial-of-service-vulnerability) (high, CVSS 7.5, published 3 Nov 2026) - [CVE-2026-29518: Rsync TOCTOU race condition in daemon file handling](https://junglewise.ai/threats/cve-2026-29518-rsync-toctou-race-condition-in-daemon-file-handling) (high, CVSS 7, published 20 May 2026) - [CVE-2026-44510: Rsync out-of-bounds read in recv_files](https://junglewise.ai/threats/cve-2026-44510-rsync-out-of-bounds-read-in-recv-files) (medium, CVSS 6.5, published 20 Jul 2026) - [CVE-2026-43620: Rsync out-of-bounds array read in recv_files](https://junglewise.ai/threats/cve-2026-43620-rsync-out-of-bounds-array-read-in-recv-files) (medium, CVSS 6.5, published 20 May 2026) - [CVE-2026-44509: RsyncProject rsync symlink race in path-based syscalls](https://junglewise.ai/threats/cve-2026-44509-rsyncproject-rsync-symlink-race-in-path-based-syscalls) (medium, CVSS 6.3, published 20 Jul 2026) - [CVE-2026-43619: Rsync symlink race condition in path-based system calls](https://junglewise.ai/threats/cve-2026-43619-rsync-symlink-race-condition-in-path-based-system-calls) (medium, CVSS 6.3, published 20 May 2026) - [CVE-2026-44507: Rsync hostname ACL bypass in chroot daemon mode](https://junglewise.ai/threats/cve-2026-44507-rsync-hostname-acl-bypass-in-chroot-daemon-mode) (medium, CVSS 4.8, published 20 Jul 2026) - [CVE-2026-43617: Rsync authorization bypass in hostname-based ACLs](https://junglewise.ai/threats/cve-2026-43617-rsync-authorization-bypass-in-hostname-based-acls) (medium, CVSS 4.8, published 20 May 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "RsyncProject Rsync vulnerabilities", https://junglewise.ai/threats/technologies/rsync, 11 November 2026.