CVE-2026-43617 Details
Description
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
An authorization bypass vulnerability has been identified in Rsync versions through 3.4.2. This vulnerability resides in the hostname-based access control list enforcement of the rsync daemon, particularly when it is configured with chroot. The issue allows attackers to circumvent hostname-based deny rules by manipulating the PTR record of their source IP address. When reverse DNS resolution fails, it defaults to 'UNKNOWN', enabling connections from hostnames that administrators intended to block.
Users can upgrade to Rsync version 3.4.3 or later, or use IP-based access control lists instead of hostname-based ones. If hostname-based ACLs must be used, ensure the chroot environment contains the necessary files for reverse DNS resolution.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/RsyncProject/rsync/releases/tag/v3.4.3 | [email protected] | Release Notes |
| https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-hostname-resolution | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| samba rsync | <= 3.4.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 20, 2026 | New CVE Received | [email protected] |