CVE-2026-43617

Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

State: Published
Severity: 6.3 Medium
Published: May 20, 2026
Updated: Jul 14, 2026
Reserved: May 1, 2026

Description

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-289 Authentication Bypass by Alternate Name

Affected Products

Product	Versions
rsyncRsyncProject	before 3.4.3Affected

References

https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4fvendor-advisory
https://github.com/RsyncProject/rsync/releases/tag/v3.4.3release-notes
https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-hostname-resolutionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.