cvedb.io
CVE-2026-43617
MEDIUM · CVSS 4.8
EPSS exploitation probability: 0%
Published 2026-05-20T02:16:36.233 · Last modified 2026-06-17T10:49:55.047

Summary

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Affected products

samba — rsync

Does this affect you?

Add your gear to cvedb and we'll alert you only when samba ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.