PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43618 RsyncProject CVE debrief

CVE-2026-43618 affects Rsync 3.4.2 and prior. A signed 32-bit counter in the compressed-token decoder is not checked for overflow, which can let a malicious sender cause the receiver to read and return data outside the intended buffer. The practical impact is information disclosure from process memory, including secrets and memory pointers that can weaken ASLR.

Vendor
RsyncProject
Product
rsync
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-05-21
Advisory published
2026-05-20
Advisory updated
2026-05-21

Who should care

Administrators and security teams running Rsync services or embedded backup/synchronization workflows, especially where the service is reachable by untrusted peers or handles sensitive data. Teams should also care if process memory may contain credentials, tokens, environment variables, or other secrets.

Technical summary

The issue is an integer overflow in Rsync's compressed-token decoder. According to the CVE record and NVD metadata, versions up to and including 3.4.2 are affected. A malformed or maliciously crafted input can overflow a 32-bit signed counter, leading the receiver process to access data beyond the intended buffer bounds and disclose process memory contents. The reported weakness categories are CWE-190 and CWE-125.

Defensive priority

Medium overall, but higher priority for internet-exposed or multi-tenant Rsync deployments and any system where exposed process memory could reveal credentials or ASLR-relevant pointers.

Recommended defensive actions

  • Upgrade Rsync to version 3.4.3 or later as the primary fix.
  • Review all exposed Rsync daemons, backup jobs, and sync endpoints to confirm whether untrusted peers can connect.
  • Restrict access with network controls and authentication where possible, especially for services that do not need broad exposure.
  • Assume sensitive data may have been present in process memory on affected systems and rotate credentials or tokens if exposure is plausible.
  • Validate that downstream packages, appliances, or embedded products shipping Rsync have incorporated the fixed release.
  • Monitor vendor advisories and deployment inventories for any instances still pinned to 3.4.2 or earlier.

Evidence notes

The supplied NVD record marks the vulnerability as analyzed and lists affected CPE coverage through Rsync 3.4.2. The record also links vendor release notes for v3.4.3 and a vendor advisory, both supporting the fix target. The description supplied with the CVE states the overflow can disclose memory contents such as environment variables, passwords, heap and stack data, and memory pointers. CVE publication time is 2026-05-20 and the NVD record was last modified 2026-05-21.

Official resources

Public records supplied here show CVE publication on 2026-05-20 and an NVD update on 2026-05-21. The linked advisory materials point to Rsync 3.4.3 as the fixed release.