Medium severity · published May 20, 2026
CVE-2026-43617
Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
rsync · RsyncProject
before 3.4.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43617
Release Notes
https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
Vendor Advisory
https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f
Third Party Advisory
https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-hostname-resolution
More from rsync
9.1
CVE-2026-53791
rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
8.2
CVE-2026-70456
rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()
8.2
CVE-2026-70457
rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
8.2
CVE-2026-70458
rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling
8.2
CVE-2026-70461
rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry