Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 20, 2026 · NIST NVD

   Detected

   Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults

2. Jul 24, 2026 · NIST NVD

   Updated

   Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults

Affected

• cpe samba/rsyncversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-43617

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-43617

  Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address,

  nvd.nist.gov

References

• Release Notes · github.com
• Vendor Advisory · github.com
• Third Party Advisory · vulncheck.com