CVE-2026-43619

🗓️ 20 May 2026 00:49:14Reported by VulnCheckType

Rsync before 3.4.3 has a symlink race in path based syscalls that enables local attackers to modify files outside the module when chroot is disabled.

Reporter	Title	Published	Views	Family All 44
ATTACKERKB	CVE-2026-43619	20 May 202600:49	–	attackerkb
AlpineLinux	CVE-2026-43619	20 May 202600:49	–	alpinelinux
CBLMariner	CVE-2026-43619 affecting package rsync for versions less than 3.4.3-1	23 May 202615:30	–	cbl_mariner
Circl	CVE-2026-43619	20 May 202603:03	–	circl
CNNVD	Rsync 后置链接漏洞	20 May 202600:00	–	cnnvd
Cvelist	CVE-2026-43619 Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls	20 May 202600:49	–	cvelist
Debian	[SECURITY] [DLA 4591-1] rsync security update	20 May 202614:39	–	debian
Debian	[SECURITY] [DSA 6282-1] rsync security update	20 May 202613:26	–	debian
Debian CVE	CVE-2026-43619	20 May 202600:49	–	debiancve
Tenable Nessus	Debian dla-4591 : rsync - security update	20 May 202600:00	–	nessus

NVD

Vulners

Node

samba rsyncRange≤3.4.2

[
  {
    "vendor": "RsyncProject",
    "product": "rsync",
    "repo": "https://github.com/RsyncProject/rsync",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThan": "3.4.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/RsyncProject/rsync/releases/tag/v3.4.3
github	www.github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735
vulncheck	www.vulncheck.com/advisories/rsync-symlink-race-condition-via-path-based-syscalls

21 May 2026 20:42Current

6Medium risk

Vulners AI Score6

CVSS 3.16.3

CVSS 47.2

EPSS0.00007

SSVC