Ubuntu 26.04 LTS rsync Important Denial of Service Issues CVE-2025-10158

ubuntu

May 20, 2026

Several security issues were fixed in rsync.

Summary

Several security issues were fixed in rsync.

Software Description:

- rsync: fast, versatile, remote (and local) file-copying tool

Details:

Calum Hutton discovered that rsync contained a heap-based out-of-bounds

read when handling file transfers. A remote attacker with read access

to an rsync server could possibly use this issue to cause a denial of

service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,

and Ubuntu 25.10. (CVE-2025-10158)

Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that

rsync daemons configured without chroot protection were exposed to a

race condition on parent path components. A local attacker with write

access to a module could possibly use this issue to overwrite files,

obtain sensitive information, or escalate privileges.

(CVE-2026-29518)

It was discovered that rsync did not properly validate a length value

while sorting extended attributes. An attacker could possibly use this

issue to cause a denial of service. (CVE-2026-4...

Read the Full Advisory

Topics Covered

security advisory denial of service remote access Ubuntu important rsync

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  rsync                           3.4.1+ds1-7ubuntu0.2

Ubuntu 25.10
  rsync                           3.4.1+ds1-5ubuntu1.2

Ubuntu 24.04 LTS
  rsync                           3.2.7-1ubuntu1.4

Ubuntu 22.04 LTS
  rsync                           3.2.7-0ubuntu0.22.04.6

In general, a standard system update will make all the necessary
changes. After a standard system update you need to restart rsync
daemons if configured to make all the necessary changes.