PT-2026-61713 · Rsync · Rsync

CVE-2026-44507 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3

Description When using a daemon configured with a chroot, the reverse DNS lookup of the connecting client is performed after the chroot has been entered. If the chroot environment lacks the necessary glibc files for resolution, such as /etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, or NSS service modules, the lookup fails and the hostname is set to "UNKNOWN". This allows an attacker controlling the PTR record of their source IP to bypass hostname-based deny rules, as the rules cannot match the "UNKNOWN" status. IP-based Access Control Lists (ACLs) remain unaffected.

Recommendations Update to version 3.4.3.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44507

Affected Products

Rsync

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44507 · Security Note
• https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f · Note
• https://twitter.com/infoflowcloud/status/2079319396518949148 · Twitter Post
• https://twitter.com/CVEnew/status/2079318787459842219 · Twitter Post