CVE catalog
CVE-2026-43619
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat t
- Severity
- High · CVSS 7.2
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.14% · Oct 25, 2026
Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rsync | sid | 3.5.1+ds1-2 | fixed |
| Debian | rsync | forky | 3.5.1+ds1-2 | fixed |
| Debian | rsync | trixie | 3.4.1+ds1-5+deb13u4 | fixed |
| Debian | rsync | trixie-security | 3.5.0+ds1-0+deb13u1 | fixed |
| Debian | rsync | bookworm | 3.2.7-1+deb12u6 | fixed |
| Debian | rsync | bookworm-security | 3.2.7-1+deb12u5 | fixed |
| Cpe | rsync | Not reported | 3.2.7-1ubuntu1.4 | fixed |
| Cpe | rsync | Not reported | Not reported | unknown |
| Cpe | rsync | Not reported | 3.2.7-1+deb12u5 | fixed |
| Alpine | rsync | 3.20 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.21 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.22 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.23 | 3.4.3-r0 | fixed |
| Alpine | rsync | 3.24 | 3.4.3-r0 | fixed |
| Ubuntu | rsync | pro | 3.1.3-6 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.1 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.2 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.3 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.4 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.5 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.7 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.8 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.9 | vulnerable |
| Ubuntu | rsync | pro | 3.1.3-8ubuntu0.9+esm1 | fixed |
| Ubuntu | rsync | 22.04 | 3.2.3-4ubuntu1 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-4ubuntu2 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu1 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu2 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu3 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.3-8ubuntu3.1 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.3 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.4 | vulnerable |
| Ubuntu | rsync | 22.04 | 3.2.7-0ubuntu0.22.04.6 | fixed |
| Ubuntu | rsync | 24.04 | 3.2.7-1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1build1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1build2 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1.1 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1.2 | vulnerable |
| Ubuntu | rsync | 24.04 | 3.2.7-1ubuntu1.4 | fixed |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-3 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-4 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-5 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-5ubuntu1 | vulnerable |
| Ubuntu | rsync | 25.10 | 3.4.1+ds1-5ubuntu1.2 | fixed |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-5ubuntu1 | vulnerable |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-6 | vulnerable |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-7 | vulnerable |
| Ubuntu | rsync | 26.04 | 3.4.1+ds1-7ubuntu0.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rsync | source | sid | 3.4.3+ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | forky | 3.4.3+ds1-1 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | trixie | 3.4.1+ds1-5+deb13u3 | not yet assigned | Not reported | Not reported |
| Debian | rsync | source | bookworm | 3.2.7-1+deb12u5 | not yet assigned | Not reported | Not reported |
| Cpe | rsync | cpe | Not reported | 3.2.7-1ubuntu1.4 | Not reported | Not reported | Not reported |
| Cpe | rsync | cpe | Not reported | 3.2.7-1+deb12u5 | Not reported | Not reported | Not reported |
| Alpine | rsync | apk | 3.20 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43619 | Not reported |
| Alpine | rsync | apk | 3.21 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43619 | Not reported |
| Alpine | rsync | apk | 3.22 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43619 | Not reported |
| Alpine | rsync | apk | 3.23 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43619 | Not reported |
| Alpine | rsync | apk | 3.24 | 3.4.3-r0 | Not reported | ALPINE-CVE-2026-43619 | Not reported |
| Ubuntu | rsync | deb | pro | 3.1.3-8ubuntu0.9+esm1 | Not reported | UBUNTU-CVE-2026-43619 | Not reported |
| Ubuntu | rsync | deb | 22.04 | 3.2.7-0ubuntu0.22.04.6 | Not reported | UBUNTU-CVE-2026-43619 | Not reported |
| Ubuntu | rsync | deb | 24.04 | 3.2.7-1ubuntu1.4 | Not reported | UBUNTU-CVE-2026-43619 | Not reported |
| Ubuntu | rsync | deb | 25.10 | 3.4.1+ds1-5ubuntu1.2 | Not reported | UBUNTU-CVE-2026-43619 | Not reported |
| Ubuntu | rsync | deb | 26.04 | 3.4.1+ds1-7ubuntu0.2 | Not reported | UBUNTU-CVE-2026-43619 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [rsync]Fixed
Details (4)
3.2.7-1+deb12u6· amd64 · bookwormFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u6· arm64 · bookwormFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u5· amd64 · bookworm-securityFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
3.2.7-1+deb12u5· arm64 · bookworm-securityFixed · Fixed:
3.2.7-1+deb12u5nvd · rsync · debian · bookworm; nvd · rsync · debian · 12
[Debian 13 (Trixie)]
- [rsync]Fixed
Details (5)
3.4.1+ds1-5+deb13u4· amd64 · trixieFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u4· arm64 · trixieFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u3· amd64 · trixie-security · Historical versionFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.4.1+ds1-5+deb13u3· arm64 · trixie-securityFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
3.5.0+ds1-0+deb13u1· amd64 · trixie-securityFixed · Fixed:
3.4.1+ds1-5+deb13u3nvd · rsync · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3629-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-43619]
- [https://osv.dev/vulnerability/ALPINE-CVE-2026-43619]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-43619]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-43619]
- [https://security-tracker.debian.org/tracker/CVE-2026-43619]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43619.json]
- [https://ubuntu.com/security/notices/USN-8283-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2455.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]