PT-2026-42051 · Rsync+2 · Rsync+2

Joshua Rogers · Published 2026-05-20 · Updated 2026-06-01 · CVE-2026-43617

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3

Description An authorization bypass exists in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record (a DNS record that maps an IP address to a hostname) for their source IP address. This allows connections from hostnames that administrators intended to deny in scenarios where reverse DNS resolution fails and defaults to UNKNOWN.

Recommendations Update to version 3.4.3 or later.

Fix

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2026-43617

ECHO-8072-9059-153B

OPENSUSE-SU-2026:10857-1

USN-8283-1

USN-8349-1

Affected Products

Linuxmint

Ubuntu

Rsync

References · 32

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f · Vendor Advisory
• https://osv.dev/vulnerability/USN-8283-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43619 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8283-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-29518 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43617 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43617 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8349-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43620 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8349-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45232 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43617 · Vendor Advisory