CVE-2026-44507 Details
Description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43617. Reason: This candidate is a duplicate of CVE-2026-43617. Notes: All CVE users should reference CVE-2026-43617 instead of this candidate.
A vulnerability in Rsync versions prior to 3.4.3 allows for a bypass of hostname-based access control lists (ACLs) when the Rsync daemon is configured with a chroot. The issue arises because the reverse DNS lookup of connecting clients is performed after entering the chroot. If the chroot does not include the necessary files for DNS resolution, such as the resolv.conf, nsswitch.conf, hosts files, and NSS service modules, the lookup fails. As a result, the connecting hostname is set to 'UNKNOWN', preventing hostname-based deny rules from functioning as intended. This allows an attacker controlling the PTR record of their IP to connect using a hostname that should have been denied. In contrast, IP-based ACLs remain unaffected.
Users can upgrade to Rsync version 3.4.3 or later to address this vulnerability. Alternatively, chroot environments can be populated with the necessary DNS resolution files or IP-based ACLs can be used instead of hostname-based ones.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
No references are available for this CVE.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Rejected | [email protected] |
| Jul 21, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |