Rsync

Access control bypass in rsync daemon versions 3.1.0 through 3.4.4 lets remote unauthenticated attackers evade module-level 'hosts deny' restrictions by forcing DNS resolution to fail during hostname-based access checks, causing the daemon to skip the rule (fail-open) instead of denying. Reported by VulnCheck and fixed in rsync 3.5.0, it exposes file trees in modules that were meant to be IP/hostname-restricted; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

CPU exhaustion in rsync receivers before 3.5.0 allows a remote sender to cause denial of service by exploiting quadratic-time worst-case behavior in the hash_search() function (CWE-407). A malicious or compromised sender delivers a carefully crafted file list - requiring only a modest number of entries - to collapse hash lookup performance and sustain receiver CPU exhaustion for the duration of the sync session. No public exploit has been identified at time of analysis, but the unauthenticated network attack vector and rsync's ubiquitous deployment in backup and file-synchronization infrastructure make patch urgency high.

TLS certificate validation bypass in rsync enables on-path attackers to intercept and tamper with encrypted file transfer sessions. Affected are rsync 3.2.0-3.2.3 in openssl mode and rsync-ssl through 3.4.4 in stunnel mode; both fail to validate server certificates against a trusted CA and perform no hostname verification, allowing a self-signed or otherwise invalid certificate to be accepted silently. No public exploit has been identified at time of analysis, and a vendor-released patch (v3.5.0, designated a major security release) is available.

Denial of service in rsync's receiver process allows a remote, unauthenticated sender to exhaust thread and memory resources by specifying the --zt short alias for --compress-threads, directly bypassing daemon-side refuse options directives that match only against long option names. Affected versions span 3.4.2 through 3.4.x prior to 3.5.0; the bypass is most damaging to operators who explicitly configured refuse options to block --compress-threads, since they believed a mitigation was in place. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.7 accurately reflects low-complexity, unauthenticated network exploitation with high availability impact.

Out-of-bounds heap write in rsync 3.0.1 through 3.4.x allows a malicious sender to corrupt adjacent heap memory by crafting an argument list that exactly fills the argv allocation in read_args(), causing the trailing NULL terminator to land one slot beyond the allocation boundary. Any rsync client performing a pull operation against an attacker-controlled or compromised server is exposed; heap corruption at this boundary can produce a crash (high availability impact) or potentially a write-what-where condition depending on heap layout. No public exploit code and no CISA KEV listing have been identified at time of analysis; rsync maintainers designated v3.5.0 a major security release, confirming patch availability.

Out-of-bounds write in rsync 3.2.3 through 3.4.x corrupts .bss-segment memory via misuse of snprintf() return semantics in parse_size_arg(), enabling remote denial-of-service and potential memory corruption with high availability impact. The CVSS 4.0 score of 8.3 with AV:N/PR:N reflects that an unauthenticated remote attacker can reach the vulnerable code path, though AC:H indicates the truncation condition requires a specifically crafted size argument. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The fix is confirmed in v3.5.0, designated a major security release by the maintainers.

Out-of-bounds write in rsync 3.0.0 through 3.4.x enables remote memory corruption when a peer sends file entries with the FLAG_HLINKED flag set against a receiver with hard-link preservation disabled. The missing F_SUM field in the file_struct layout permits writes beyond the allocated structure boundary, corrupting adjacent heap or stack data and likely causing denial-of-service or potentially enabling code execution. Vendor-released patch v3.5.0 is available; no public exploit or CISA KEV listing has been confirmed at time of analysis.

Remote unauthenticated crash of the rsync daemon affects all versions from 3.0.0 through 3.4.x. The daemon child process dereferences the first file list entry as a directory structure pointer without verifying its type, so a dot entry not typed as a directory triggers a null or uninitialized pointer dereference (CWE-908) that terminates the connection. Impact is constrained to availability - a denial-of-service against individual daemon connections - with no confidentiality or integrity exposure. No CISA KEV listing and no confirmed public exploit code exist at time of analysis.

Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symlinks that are followed while resolving the --partial-dir or --backup-dir paths, redirecting writes to the module-root parent and beyond. Any rsync daemon exposing a writable module - or a read/write sync where a sender controls symlinks - is exposed, and the CWE-22 path-traversal primitive can be leveraged to overwrite configuration, cron, or authorized_keys files for follow-on code execution. Fixed in v3.5.0; reported by VulnCheck with no public exploit identified at time of analysis.

Heap out-of-bounds write in rsync 3.2.5 through 3.4.x allows remote unauthenticated attackers to corrupt heap memory by supplying a crafted files-from entry to any exposed rsync daemon module. Critically, the flaw is exploitable against read-only daemon modules - a configuration commonly treated as a safe exposure boundary - by providing a path containing both an interior and trailing backslash, causing add_implied_include() to under-size its destination buffer and write one attacker-controlled byte past the allocation end. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.8 reflects the unauthenticated network attack vector and high availability impact.

Signed integer overflow in rsync 3.1.0 through 3.4.x allows network-accessible attackers to permanently disable connection timeouts on a daemon by injecting crafted MSG_IO_TIMEOUT messages carrying zero or negative values, ultimately enabling resource exhaustion via indefinitely held daemon slots. All deployments running the rsync daemon in the affected range are exposed; the fix is confirmed in rsync 3.5.0, released as a major security update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-privilege, low-complexity network attack path makes unpatched internet-facing daemons a meaningful target.

Authorization bypass in rsync 3.1.0 through 3.4.x allows authenticated users to circumvent module-level access controls when group-based deny rules are configured with space-containing group names. The auth users directive's comma-only parser silently discards deny rules for any @Group Name entry whose group name contains a space, granting unintended access to restricted rsync modules regardless of the administrator's intended group-based exclusions. The rsync project designated v3.5.0 a major security release to address this flaw; no CISA KEV listing or public exploit code has been identified at time of analysis.

Connection slot exhaustion in rsync daemon versions 2.0.0 through 3.4.x allows unauthenticated remote attackers to deny service to legitimate clients by stalling the protocol handshake across two distinct vectors. Pre-module-selection stalls are unconditionally effective because the daemon applies no timeout in that phase; post-module-selection, attackers can trickle data just above the I/O timeout floor to hold slots indefinitely while never completing the handshake. No public exploit identified at time of analysis, though the attack is trivially scriptable and requires no authentication or prior access.

Symlink race condition in rsync before 3.5.0 allows directory traversal beyond the configured module root during sender-side scanning. Attackers with write access to a path component of the scanned tree can exploit a TOCTOU window between lstat() and opendir() system calls to redirect traversal outside the module boundary, causing rsync to enumerate and transfer files from unintended filesystem locations. This affects both daemon-mode and non-daemon sender-side scanning configurations; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Symlink race condition in rsync before 3.5.0 allows local attackers with symlink creation privileges to cause arbitrary file deletion via the --remove-source-files feature. By atomically substituting a symlink for a source file in the narrow TOCTOU window between transfer completion and the unlink() call, an attacker redirects deletion to any file the rsync process can reach. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Symlink race condition in rsync before 3.5.0 enables local privilege escalation by allowing an attacker to redirect ACL and extended attribute application to arbitrary files outside the intended destination tree. A low-privileged local attacker exploits the timing window between rsync's file write and the subsequent acl_set_file() or lsetxattr() call by substituting a crafted symlink at a predictable destination path, causing rsync to stamp permissions onto unintended files. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; however, the CVSS 4.0 score of 7.2 reflects genuine high confidentiality and integrity impact when successfully timed.

File content disclosure in rsync before 3.5.0 allows a local attacker with write access to a parent directory of the rsync source tree to redirect file reads to arbitrary paths outside the intended transfer root. By atomically replacing a directory component with a symlink between path resolution and file open operations - a classic TOCTOU race condition - the attacker causes the rsync sender to traverse outside its intended scope, exposing sensitive file contents. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 5.7 (local vector, high complexity) reflects the constrained but meaningful real-world impact.

TOCTOU race condition in rsync before 3.5.0 allows a local attacker who controls parent directory components of the destination path to redirect file writes to arbitrary filesystem locations outside the intended destination tree. Exploitation targets the non-daemon receiver code path, where a symlink can be substituted for a path component between rsync's path resolution step and its chdir() call. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released fix is rsync v3.5.0.

Arbitrary file write in rsync before 3.5.0 allows attackers who control --temp-dir or --link-dest option values to escape the intended destination tree by supplying absolute paths, bypassing the rename-confinement security boundary. Any filesystem location writable by the rsync process can be targeted, enabling overwrite of system files, configuration, or planted malicious content. No public exploit identified at time of analysis, but the CVSS 4.0 score of 7.2 with high integrity and availability impact reflects serious real-world risk in server environments where option values are externally influenced.

Memory exhaustion in rsync before 3.5.0 exposes receivers to remote denial of service through a logic error in --max-alloc handling, where passing --max-alloc=0 silently disables all allocation sanity checks instead of enforcing a zero-byte cap. Any rsync receiver reachable from an untrusted sender - including public mirrors and unauthenticated daemons - is at risk, as the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required to trigger the flaw. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the trivial trigger condition makes this a credible remote DoS threat against exposed rsync endpoints.

Path confinement bypass in the rsync daemon (versions before 3.5.0) lets remote clients escape the intended per-module chroot root when a module path contains a '/./' boundary marker, granting unauthorized read or write access to files outside the module subtree. Reported by VulnCheck and carrying a CVSS 4.0 score of 9.1, the flaw is exploitable by mishandling the '/./' notation or by forging delta-basis (xname) transfers that cross the boundary. No public exploit has been identified at time of analysis, but the fix is a coordinated advisory (GHSA-wj7w-vh23-mm44) shipped in the major 3.5.0 security release.

Out-of-bounds read in rsync's sender-side block matching logic exposes systems running rsync before 3.5.0 to a denial-of-service condition when syncing with a malicious or compromised receiver. The vulnerability stems from missing validation of zero-length checksum blocks: when a receiver sends such a block, the sender performs a negative offset calculation during delta computation, reading memory before the start of an allocated file data buffer. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the CVSS 4.0 score of 7.1 (VA:H) reflects the practical crash risk for any rsync client connecting to an untrusted server.

IP-based access control bypass in the rsync daemon (rsyncproject/rsync) before version 3.5.0 lets unauthenticated remote attackers forge their source address by injecting a crafted PROXY protocol header, defeating hosts allow/deny restrictions. Reported by VulnCheck and fixed in the v3.5.0 major security release, the flaw applies to daemons that trust PROXY protocol headers yet accept direct client connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact once the IP allowlist is circumvented.

Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection - that let an attacker who controls hostnames, hostspecs, or related input inject shell metacharacters or newlines and run commands as the rsync process or invoking user. VulnCheck reported the cluster of CWE-78 flaws, which are fixed together in the major security release v3.5.0. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the CVSS 4.0 base score of 9.2 reflects full confidentiality, integrity, and availability impact.

Arbitrary file deletion in rsync before 3.5.0 allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list. All rsync versions prior to 3.5.0 are affected through multiple attack variants including implied parent directory reclassification, synthetic root path construction, legacy protocol behavior (protocol version below 30), and non-directory root handling. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 7.1 with network vector and low complexity reflects meaningful real-world risk for any deployment that syncs from potentially untrusted or compromised senders with --delete enabled.

Newline injection in rsync's name-converter uid/gid mapping interface (all versions before 3.5.0) allows local attackers to forge protocol messages by embedding newline characters in OS-level user or group names. Because the rsync daemon communicates with the name-converter over a pipe-based, line-oriented protocol, injected newlines create false protocol boundaries, causing the daemon to parse attacker-controlled strings as legitimate protocol directives and corrupting uid/gid mapping logic. No public exploit code and no CISA KEV listing are identified at time of analysis; rsync 3.5.0 was designated a major security release to address this issue.

File ownership privilege confusion in rsync before 3.5.0 allows local attackers to cause transferred files to be assigned root (uid/gid 0) ownership by manipulating the name-converter subprocess into returning empty uid/gid lookup responses. The flaw stems from rsync misinterpreting an empty name-converter response as a valid resolution to uid/gid 0 rather than rejecting it as a lookup failure. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor-released fix is rsync v3.5.0, designated a major security release.

Filter rule bypass in rsync before 3.5.0 allows remote clients connecting to an rsync daemon to override module-level filter restrictions by injecting malicious --filter merge file directives during filter evaluation. The daemon's intended access controls - designed to restrict which files a module exposes - can be circumvented, granting the attacker read and limited write access to files the module filter was meant to exclude. No public exploit has been identified at time of analysis, and the vendor has released a fix in v3.5.0 designated as a major security release.

Path traversal in rsync before 3.5.0 allows a malicious sender to write arbitrary files outside the receiver's intended destination directory by exploiting symlink following in --relative mode. The make_path() function creates intermediate directories while following symlinks without enforcing that resolved paths stay within the destination tree boundary, enabling controlled file writes to arbitrary locations on the receiver's filesystem. No public exploit or CISA KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 6.9 with high integrity and availability impact reflects meaningful real-world risk given rsync's ubiquity in backup and synchronization workflows.

Path traversal in rsync daemon before 3.5.0 allows remote rsync clients to read and write files outside the configured module root. The root cause is the daemon calling chdir() to the module root at session start without resolving symlinks via realpath(), so if the module root path or any path component is a symlink, subsequent relative-path operations resolve against the symlink target instead of the intended directory. Exploitation requires two server-side conditions - use chroot disabled and a symlink anywhere in the module root path - but no special conditions on the attacker side beyond having rsync client access to the module. No public exploit code or CISA KEV listing is identified at time of analysis.

Directory escape in rsync's rrsync restricted shell wrapper before version 3.5.0 allows authenticated users to read and write files outside their enforced directory boundaries via two distinct paths. The first is a TOCTOU race condition that substitutes a symlink after path validation but before file transfer; the second is direct abuse of unrestricted rsync flags - --copy-unsafe-links, -D, and --log-file - that rrsync fails to sanitize, requiring no race timing at all. Scored 8.6 (High) under CVSS 4.0 with full confidentiality and integrity compromise of the vulnerable system, this is a genuine priority for any deployment using rrsync for SSH-based restricted file sharing; no public exploit has been identified at time of analysis.

Symlink following in rsync before 3.5.0 enables local privilege escalation by allowing a low-privileged attacker to redirect ancillary file writes - such as log files, batch files, or daemon statistics - to arbitrary filesystem locations. Affected installations are those where rsync executes with elevated privileges, specifically setuid binaries or privileged daemon configurations, making the impact proportional to how widely such configurations are deployed. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.5 and the designation of v3.5.0 as a 'major security release' by the rsync maintainers signal this is treated as a high-severity finding.

Arbitrary file read in rsync before 3.5.0 enables attackers with local low-privilege access to read files accessible to the rsync daemon process by exploiting improper symlink resolution in input configuration file handling. The vulnerability affects --files-from, --password-file, and filter merge file paths, allowing placement of a symlink at a predictable argument path or supply of a --files-from path that escapes the daemon module root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vendor has released a confirmed fix in rsync 3.5.0.

rsync client versions prior to 3.4.3 crash deterministically when connecting to a malicious sender due to an out-of-bounds array read in recv_files(). Any client performing a standard recursive pull - the default behavior since protocol version 30 - against an attacker-controlled rsync server or URL is exposed without any special victim-side configuration. Impact is strictly denial-of-service (client crash via SIGSEGV); remote code execution has been explicitly ruled out on glibc x86-64 Linux, though non-glibc allocators remain unaudited. No public exploit identified at time of analysis; vendor-released patch is available in version 3.4.3.

Heap and stack memory disclosure in rsync versions prior to 3.4.3 lets a malicious sender leak process memory from a receiver by overflowing an unchecked 32-bit signed counter in the compressed-token decoder. The leaked contents can include environment variables, passwords, and heap/stack/library pointers, undermining ASLR and enabling follow-on exploitation. No public exploit is identified at time of analysis, there is no CISA KEV listing, and EPSS was not provided, so real-world exploitation should be treated as unproven but plausible.

Rsync daemon before version 3.4.3 allows hostname-based access control rules to be silently bypassed when the daemon is configured with chroot and the chroot directory lacks the files glibc requires for DNS resolution. When resolution fails inside the chroot, the client hostname is set to "UNKNOWN", which never matches administrator-defined "hosts deny" hostname patterns, effectively nullifying those rules. An attacker who controls the PTR record for their source IP can exploit this to connect to an rsync module they were explicitly denied access to; no public exploit code is identified and this is not listed in CISA KEV.

Rsync daemon versions prior to 3.4.3 expose a symlink race condition (TOCTOU) in path-based system calls - specifically chmod() and chown() - that prior security patches overlooked when fixing analogous races in open(). When deployed with 'use chroot = no', an attacker with local filesystem write access to an exported module directory can redirect these calls through a symlink to files outside the module boundary, altering permissions, ownership, or timestamps on otherwise inaccessible files. No public exploit has been identified at time of analysis, and the issue is addressed in rsync 3.4.3.

Local privilege escalation in Rsync daemon (versions ≤ 3.4.2) is possible via a TOCTOU symlink race when the daemon is configured with 'use chroot = no'. An authenticated local attacker with write access to a module can swap a parent directory component for a symlink between the receiver's path check and its open() call, redirecting writes outside the module and overwriting sensitive files. No public exploit identified at time of analysis, but the upstream patch in release 3.4.3 and a detailed VulnCheck advisory disclose the precise race window.

Hostname-based ACL bypass in the rsync daemon (rsync ≤ 3.4.2) allows unauthenticated remote attackers to circumvent administrator-configured deny rules when the daemon runs with chroot enabled. By manipulating the PTR record for their source IP or engineering a reverse DNS resolution failure, an attacker causes the daemon to fall back to the default hostname 'UNKNOWN', which does not match any configured deny entry and therefore permits the connection. Confidentiality and integrity are both partially at risk; no public exploit has been identified at time of analysis, and a vendor-released patch (v3.4.3) is available.

Information disclosure in Rsync 3.4.2 and prior allows an authenticated remote sender to leak receiver process memory through an integer overflow in the compressed-token decoder. The flaw exposes environment variables, credentials, heap and stack contents, and library pointers, weakening ASLR and enabling follow-on exploitation; no public exploit identified at time of analysis, but Rsync 3.4.3 bundles the security fix.

Symlink race condition in Rsync 3.4.2 and earlier allows local attackers with filesystem access to redirect path-based system calls (chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, lstat) to files outside the exported rsync module boundary. The flaw affects rsync daemons configured with 'use chroot = no' and was reported by VulnCheck; no public exploit identified at time of analysis. A patched release (v3.4.3) is available from the RsyncProject upstream, which adds openat2 RESOLVE_BENEATH for secure relative path resolution.

Receiver-side out-of-bounds array read in Rsync 3.4.2 and earlier allows a malicious rsync server to deterministically crash any connecting client process via a crafted synchronization session. The flaw in recv_files() causes the client to dereference an invalid pointer at an unmapped address, producing a reliable SIGSEGV. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the crash is described as deterministic, meaning any attacker controlling or impersonating an rsync server can reliably deny service to clients that connect.

Stack memory corruption in rsync before 3.4.3 allows network-positioned attackers to write a null byte past the end of a fixed-size stack buffer in the establish_proxy_connection() function in socket.c. The vulnerability is only reachable when the RSYNC_PROXY environment variable is set and an attacker controls or intercepts traffic to the configured HTTP proxy. Impact is constrained to a low-severity availability disruption (process crash) with no confidentiality or integrity exposure; no public exploit has been identified at time of analysis.

Receiver-side use-after-free in rsync 3.0.1 through 3.4.1 lets a malicious peer corrupt memory on a host running rsync with the -X (--xattrs) option. The receive_xattr function trusts an attacker-supplied length value during a qsort operation, which a malicious sender/server can abuse to crash the receiver or potentially achieve code execution; Linux hosts are vulnerable in many common configurations and non-Linux platforms more broadly. No public exploit identified at time of analysis, EPSS is very low (0.01%), and SSVC scores exploitation as none, indicating a real-but-not-urgent memory-safety bug rather than a mass-exploited threat.

A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Arbitrary file write outside the intended destination in rsync's client-side `--safe-links` handling allows a malicious or compromised rsync server to bypass the symlink safety check via a path-traversal flaw (CWE-22). The client fails to recursively verify whether a symbolic-link target supplied by the server itself contains a nested symlink, so a controlled server can place files anywhere the rsync process can write. A detailed advisory was published by Google's security-research team (GHSA-p5pg-x43v-mvqj) as part of the January 2025 rsync vulnerability cluster, but the issue is not in CISA KEV and no public exploit identified at time of analysis; EPSS is moderate at 2.89% (86th percentile).

Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's intended destination directory by abusing the `--inc-recursive` incremental-recursion mode. Because the server can negotiate `--inc-recursive` even when the client does not request it, missing symlink validation combined with per-file-list deduplication allows arbitrary file placement on the connecting client. Publicly available exploit code exists, EPSS is 3.19% (87th percentile), and Red Hat has shipped fixes, but it is not currently listed in CISA KEV.

A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.1%.

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

The parse_arguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, does not check for fnamecmp filenames in the daemon_filter_list data structure (in the recv_files function in receiver.c) and also. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The recv_files function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds with certain file metadata updates before checking for a filename in the. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.

The receive_xattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

rsync 3.1.1 allows remote attackers to write to arbitrary files via a symlink attack on a file in the synchronization path. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 17.2% and no vendor patch available.