CVE catalog
CVE-2026-43617
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostn
- Severity
- Medium · CVSS 6.3
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.28% · Oct 25, 2026
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rsync | sid | 3.5.1+ds1-2 | fixed |
| Debian | rsync | forky | 3.5.1+ds1-2 | fixed |
| Debian | rsync | trixie | 3.4.1+ds1-5+deb13u4 | fixed |
| Debian | rsync | trixie-security | 3.5.0+ds1-0+deb13u1 | fixed |
| Debian | rsync | bookworm | 3.2.7-1+deb12u6 | fixed |
| Debian | rsync | bookworm-security | 3.2.7-1+deb12u5 | fixed |
| Cpe | rsync | Not reported | 3.2.7-1ubuntu1.4 | fixed |
| Cpe | rsync | Not reported | Not reported | unknown |
| Cpe | rsync | Not reported | 3.2.7-1+deb12u5 | fixed |
| Alpine | rsync | 3.20 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.21 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.22 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.23 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.24 | 3.4.3-r0 | fixed |
| Suse | rsync | linux enterprise server 16.0 | 3.4.1-160000.6.1 | fixed |
| Suse | rsync | linux enterprise server for sap applications 16.0 | 3.4.1-160000.6.1 | fixed |
| Suse | rsync | linux micro 6.2 | 3.4.1-160000.6.1 | fixed |
| Suse | rsync | linux micro 6.0 | 3.2.7-8.1 | fixed |
| Opensuse | rsync | leap 16.0 | 3.4.1-160000.6.1 | fixed |
| Ubuntu | rsync | pro | 3.1.3-6 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.1 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.2 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.3 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.4 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.5 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.7 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.8 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.9 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.9+esm1 | fixed |
| Ubuntu | rsync | 22.04 | 3.2.3-4ubuntu1 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-4ubuntu2 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu1 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu2 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu3 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu3.1 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.3 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.4 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.6 | fixed |
| Ubuntu | rsync | 24.04 | 3.2.7-1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1build1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1build2 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1.1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1.2 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1.4 | fixed |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-3 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-4 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-5 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-5ubuntu1 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-5ubuntu1.2 | fixed |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-5ubuntu1 | vulnerable |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-6 | vulnerable |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-7 | vulnerable |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-7ubuntu0.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rsync | source | sid | 3.4.3+ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | forky | 3.4.3+ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | trixie | 3.4.1+ds1-5+deb13u3 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | bookworm | 3.2.7-1+deb12u5 | not yet assigned | Not reported | Not reported |
| Cpe | rsync | cpe | Not reported | 3.2.7-1ubuntu1.4 | Not reported | Not reported | Not reported |
| Cpe | rsync | cpe | Not reported | 3.2.7-1+deb12u5 | Not reported | Not reported | Not reported |
| Alpine | rsync | apk | 3.20 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43617 | Not reported |
| Alpine | rsync | apk | 3.21 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43617 | Not reported |
| Alpine | rsync | apk | 3.22 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43617 | Not reported |
| Alpine | rsync | apk | 3.23 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43617 | Not reported |
| Alpine | rsync | apk | 3.24 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43617 | Not reported |
| Suse | rsync | rpm | linux enterprise server 16.0 | 3.4.1-160000.6.1 | Not reported | SUSE-SU-2026:23323-1 | Not reported |
| Suse | rsync | rpm | linux enterprise server for sap applications 16.0 | 3.4.1-160000.6.1 | Not reported | SUSE-SU-2026:23323-1 | Not reported |
| Suse | rsync | rpm | linux micro 6.2 | 3.4.1-160000.6.1 | Not reported | SUSE-SU-2026:23289-1 | Not reported |
| Suse | rsync | rpm | linux micro 6.0 | 3.2.7-8.1 | Not reported | SUSE-SU-2026:23253-1 | Not reported |
| Opensuse | rsync | rpm | leap 16.0 | 3.4.1-160000.6.1 | Not reported | OPENSUSE-SU-2026:21650-1 | Not reported |
| Ubuntu | rsync | deb | pro | 3.1.3-8ubuntu0.9+esm1 | Not reported | UBUNTU-CVE-2026-43617 | Not reported |
| Ubuntu | rsync | deb | 22.04 | 3.2.7-0ubuntu0.22.04.6 | Not reported | UBUNTU-CVE-2026-43617 | Not reported |
| Ubuntu | rsync | deb | 24.04 | 3.2.7-1ubuntu1.4 | Not reported | UBUNTU-CVE-2026-43617 | Not reported |
| Ubuntu | rsync | deb | 25.10 | 3.4.1+ds1-5ubuntu1.2 | Not reported | UBUNTU-CVE-2026-43617 | Not reported |
| Ubuntu | rsync | deb | 26.04 | 3.4.1+ds1-7ubuntu0.2 | Not reported | UBUNTU-CVE-2026-43617 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [rsync]Fixed
Details (4)
3.2.7-1+deb12u6· amd64 · bookwormFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u6· arm64 · bookwormFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
[Debian 13 (Trixie)]
- [rsync]Fixed
Details (5)
3.4.1+ds1-5+deb13u4· amd64 · trixieFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u4· arm64 · trixieFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u3· amd64 · trixie-security · Historical versionFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u3· arm64 · trixie-securityFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.5.0+ds1-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23253-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-43617]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-43617]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-43617]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23253-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23289-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23323-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-43617]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21650-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-43617]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43617.json]
- [https://ubuntu.com/security/notices/USN-8283-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2455.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]