CVE-2026-43620

The check_secret function in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service via a user name which does not exist in the secrets file, leading to an infinite loop and CPU consumption.

The rsync daemon before version 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

A heap-based buffer overflow vulnerability was found in the rsync daemon due to improper handling of attacker-controlled checksum lengths (s2length). When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

A flaw in rsync causes the client to improperly verify symbolic link destinations when using the `--safe-links` option, allowing path traversal and arbitrary file write outside the intended directory.

A flaw in rsync allows an attacker to manipulate the checksum length (s2length) during file checksum comparison, causing a comparison with uninitialized memory and leaking one byte of stack data at a time.

The daemon in rsync versions 3.1.2 and 3.1.3-development before 2017-12-03 does not check fnamecmp filenames in the daemon_filter_list data structure and does not apply the sanitize_paths protection mechanism to pathnames found in 'xname follows' strings. This allows remote attackers to bypass intended access restrictions.

Rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions.

rsync daemon versions 2.0.0 before 3.5.0 contain a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.

rsync versions 3.1.0 before 3.5.0 contain an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

rsync versions 3.1.0 through before 3.5.0 contain a signed integer overflow vulnerability in the I/O timeout implementation. Attackers can inject MSG_IO_TIMEOUT messages with non-positive values, causing the timeout variable to wrap and permanently disabling connection timeouts, allowing idle connections to hold daemon slots indefinitely and leading to resource exhaustion.