CVE-2026-43620

A flaw was found in rsync. A malicious rsync server can exploit an out-of-bounds read vulnerability in the recv_files() function. By manipulating compatibility flags and transfer records, the server can cause a connecting client to attempt to read memory outside of allocated bounds. This can lead to a segmentation fault, resulting in a denial of service for the client.

This Moderate impact flaw in rsync clients allows a remote, unauthenticated attacker to cause a denial-of-service by crafting a malicious rsync server. When a client pulls from such a server, an out-of-bounds read occurs due to an incomplete fix, leading to a deterministic crash. This affects any rsync client performing a normal pull from an attacker-controlled URL, as the inc_recurse option, which is enabled by default, facilitates the exploit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, rsync clients can be configured to disable incremental recursion when pulling from untrusted sources. This can be achieved by using the --no-inc-recursive option. Example: rsync --no-inc-recursive [OPTIONS] SOURCE DESTINATION Disabling incremental recursion may affect the efficiency of transfers for large, frequently updated directories.