CVE-2026-70457: rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.
- CVE-2026-70457CVE identifier
- 8.3CVSS 4.0 base score (high)
- 0.4%EPSS: chance of exploitation in the next 30 days (higher than 32% of CVEs)
- 2026-08-13published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run rsync and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- sudo systemctl restart rsync (only if rsyncd runs as a daemon; client use needs no restart)
Affected and fixed versions
Affected:
- RsyncProject rsync 3.2.3 to 3.4.4
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade rsyncUbuntu
sudo apt update
sudo apt install --only-upgrade rsyncRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh rsyncFedora
sudo dnf upgrade --refresh rsyncSUSE / openSUSE
sudo zypper refresh
sudo zypper update rsyncAmazon Linux
sudo dnf upgrade --releasever=latest rsyncArch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade rsyncFreeBSD
pkg update && pkg upgrade rsyncGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | rsync | not fixed yet | |
| Debian 13 | rsync | fixed | 3.5.0+ds1-0+deb13u1 |
| Debian testing | rsync | fixed | 3.5.0+ds1-1 |
| Red Hat Enterprise Linux 9 | rsync-0:3.2.7-1.el9_8 | fixed | RHSA-2026:67462 |
| Red Hat Enterprise Linux 10 | rsync-0:3.5.0-3.el10_2 | fixed | RHSA-2026:67463 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
- https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg
- CVE-2026-70457 on CVE.org
- CVE-2026-70457 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.