The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1362 advisory.

    This advisory aggregates security fixes for the rsync SRPM in CIQ LTS 9.6. It addresses 12 CVEs:
    CVE-2026-45232, CVE-2026-29518, CVE-2025-10158, CVE-2014-2855, CVE-2024-12086, and 7 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0491 advisory.

    This advisory aggregates security fixes for the rsync SRPM in CIQ LTS 9.2. It addresses 4 CVEs:
    CVE-2014-2855, CVE-2006-2083, CVE-2024-12085, CVE-2018-5764.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0255 advisory.

    This advisory aggregates security fixes for the rsync SRPM in CIQ LTS 8.6. It addresses 5 CVEs:
    CVE-2025-4638, CVE-2014-2855, CVE-2006-2083, CVE-2016-9840, CVE-2018-5764.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated rsync package fixes security vulnerability :

Ryan Finnie discovered that rsync 3.1.0 contains a denial of service issue when attempting to authenticate using a nonexistent username. A remote attacker could use this flaw to cause a denial of service via CPU consumption (CVE-2014-2855).

Rsync was updated to fix a denial of service attack that could be used by remote attackers without authentification (CVE-2014-2855).

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2171-1 advisory.

    Ryan Finnie discovered that the rsync daemon incorrectly handled invalid usernames. A remote attacker     could use this issue to cause rsync to consume resources, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes CVE-2014-2855 and temporary reverts compilation with system provided zlib(BZ#1043965).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
356838	Rocky Linux 9.6 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_1362)	Nessus	Rocky Linux Local Security Checks	Local	high
354984	Rocky Linux 9.2 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (ciqsa-2026_0491)	Nessus	Rocky Linux Local Security Checks	Local	high
354731	Rocky Linux 8.6 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (ciqsa-2026_0255)	Nessus	Rocky Linux Local Security Checks	Local	critical
82384	Mandriva Linux Security Advisory : rsync (MDVSA-2015:131)	Nessus	Mandriva Local Security Checks	Local	medium
75342	openSUSE Security Update : Rsync (openSUSE-SU-2014:0595-1)	Nessus	SuSE Local Security Checks	Local	high
73681	Ubuntu 14.04 LTS : rsync vulnerability (USN-2171-1)	Nessus	Ubuntu Local Security Checks	Local	high
73631	Fedora 20 : rsync-3.1.0-3.fc20 (2014-5315)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2014-2855

high

Tenable Plugins

high

high

critical

medium

high

high

high