Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

The remote host is affected by the vulnerability described in GLSA-202608-03 (rsync: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in rsync. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Rsync version  3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's     hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-     based deny rules by controlling the PTR record for their source IP address, allowing connections from     hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to     UNKNOWN.(CVE-2026-43617)

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder     where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an     overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment     variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR     effectiveness and facilitating further exploitation.(CVE-2026-43618)

    Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the     establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by     sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the     client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a     newline terminator, causing a null byte to be written to an out-of-bounds stack address when the     RSYNC_PROXY environment variable is set.(CVE-2026-45232)

    Rsync version  3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in     recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
    Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a     specially crafted file list where the first sorted entry is not the leading dot directory, followed by a     transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes     before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in     a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Rsync version  3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's     hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-     based deny rules by controlling the PTR record for their source IP address, allowing connections from     hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to     UNKNOWN.(CVE-2026-43617)

    Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the     establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by     sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the     client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a     newline terminator, causing a null byte to be written to an out-of-bounds stack address when the     RSYNC_PROXY environment variable is set.(CVE-2026-45232)

    Rsync version  3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in     recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
    Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a     specially crafted file list where the first sorted entry is not the leading dot directory, followed by a     transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes     before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in     a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder     where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an     overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment     variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR     effectiveness and facilitating further exploitation.(CVE-2026-43618)

    In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely     vulnerable.(CVE-2026-41035)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's     hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-     based deny rules by controlling the PTR record for their source IP address, allowing connections from     hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to     UNKNOWN.(CVE-2026-43617)

    Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls     including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow     local attackers to redirect operations to files outside the exported rsync module. Attackers with local     filesystem access can exploit the timing window between path resolution and syscall execution by swapping     symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files     outside the intended module boundary on rsync daemons configured with 'use chroot = no'.(CVE-2026-43619)

    Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file     handling that allows attackers to redirect file writes outside intended directories by replacing parent     directory components with symbolic links. Attackers with write access to a module path can exploit this     race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and     achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only     be triggered if the chroot setting is false.(CVE-2026-29518)

    In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call,     leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many     (but not all) common configurations are vulnerable. Non-Linux platforms are more widely     vulnerable.(CVE-2026-41035)

    Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder     where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an     overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment     variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR     effectiveness and facilitating further exploitation.(CVE-2026-43618)

    Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the     establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by     sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the     client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a     newline terminator, causing a null byte to be written to an out-of-bounds stack address when the     RSYNC_PROXY environment variable is set.(CVE-2026-45232)

    Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in     recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process.
    Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a     specially crafted file list where the first sorted entry is not the leading dot directory, followed by a     transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes     before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in     a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the rsync package has been released.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04e445b3f advisory.

    New version 3.4.4 with multiple regression fixes. This update also fixes the following CVEs:
    CVE-2026-29518 CVE-2026-43617 CVE-2026-43618 CVE-2026-43619 CVE-2026-43620 CVE-2026-45232

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8349-1 advisory.

    Calum Hutton discovered that rsync contained a heap-based out-of-bounds read when handling file transfers.
    A remote attacker with read access to an rsync server could possibly use this issue to cause a denial of     service. (CVE-2025-10158)

    Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that rsync daemons configured without     chroot protection were exposed to a race condition on parent path components. A local attacker with write     access to a module could possibly use this issue to overwrite files, obtain sensitive information, or     escalate privileges. (CVE-2026-29518)

    It was discovered that rsync did not properly validate a length value while sorting extended attributes.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41035)

    It was discovered that rsync performed reverse-DNS lookups after chrooting in some daemon configurations.
    A remote attacker could possibly use this issue to bypass hostname-based access controls and access     network services. (CVE-2026-43617)

    Omar Elsayed discovered that rsync did not properly check for integer overflows while decoding compressed     tokens. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43618)

    Andrew Tridgell discovered that rsync did not fully fix a symlink race condition in path-based system     calls for daemons configured without chroot protection. A local attacker could possibly use this issue to     overwrite files, obtain sensitive information, or escalate privileges. (CVE-2026-43619)

    Pratham Gupta discovered that rsync did not properly validate an index while processing file lists. A     remote attacker could possibly use this issue to cause rsync to crash, resulting in a denial of service.
    (CVE-2026-43620)

    Michal Ruprich discovered that rsync contained an off-by-one error while handling HTTP proxy responses. An     attacker able to intercept network communications or a malicious proxy server could possibly use this     issue to cause a denial of service. (CVE-2026-45232)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2083-1 advisory.

    This update for rsync fixes the following issues

    - CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
    - CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
    - CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
    - CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
    - CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
    - CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2038-1 advisory.

    This update for rsync fixes the following issues


    - CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
    - CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
    - CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
    - CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
    - CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
    - CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
    - CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2048-1 advisory.

    This update for rsync fixes the following issues

    - CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
    - CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
    - CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
    - CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
    - CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ecca89eb-54e6-11f1-bc4a-40b034429ecf advisory.

    The rsync project reports:
    Six CVEs are fixed in this release. All six are assigned by VulnCheck as CNA.
                Affected versions are 3.4.2 and earlier in every case.
    In addition to the six CVE fixes, this release adds defence-in-depth                     hardening on several adjacent paths: bounded wire-supplied counts and                     lengths in flist/io/acls/xattrs, a guard against length underflow in                     cumulative snprintf() callers, a parent block-index bounds check on the                     receiver, a NULL check in read_delay_line(), a lower ceiling on                     MAX_WIRE_DEL_STAT to avoid signed-int overflow in the read_del_stats()                     accumulator, rejection of hyphen-prefixed remote-shell hostnames                     (defence-in-depth against argv-injection in tooling that forwards untrusted                     input into the hostspec position; reported by Aisle Research via Michal                     Ruprich), and a NULL-check on localtime_r() in timestring() to keep a                     malicious server from crashing the client by advertising a file with an                     out-of-range modtime.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8283-1 advisory.

    Calum Hutton discovered that rsync contained a heap-based out-of-bounds read when handling file transfers.
    A remote attacker with read access to an rsync server could possibly use this issue to cause a denial of     service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-10158)

    Batuhan Sancak, Damien Neil, and Michael Stapelberg discovered that rsync daemons configured without     chroot protection were exposed to a race condition on parent path components. A local attacker with write     access to a module could possibly use this issue to overwrite files, obtain sensitive information, or     escalate privileges. (CVE-2026-29518)

    It was discovered that rsync did not properly validate a length value while sorting extended attributes.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41035)

    It was discovered that rsync performed reverse-DNS lookups after chrooting in some daemon configurations.
    A remote attacker could possibly use this issue to bypass hostname-based access controls and access     network services. (CVE-2026-43617)

    Omar Elsayed discovered that rsync did not properly check for integer overflows while decoding compressed     tokens. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43618)

    Andrew Tridgell discovered that rsync did not fully fix a symlink race condition in path-based system     calls for daemons configured without chroot protection. A local attacker could possibly use this issue to     overwrite files, obtain sensitive information, or escalate privileges. (CVE-2026-43619)

    Pratham Gupta discovered that rsync did not properly validate an index while processing file lists. A     remote attacker could possibly use this issue to cause rsync to crash, resulting in a denial of service.
    (CVE-2026-43620)

    Michal Ruprich discovered that rsync contained an off-by-one error while handling HTTP proxy responses. An     attacker able to intercept network communications or a malicious proxy server could possibly use this     issue to cause a denial of service. (CVE-2026-45232)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of rsync installed on the remote host is prior to 3.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-141-02 advisory.

    New rsync packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the rsync security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder
    where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an
    overflow that causes the receiver process to read and return data from outside the intended buffer bounds.
    Attackers can exploit this vulnerability to disclose process memory contents including environment
    variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR
    effectiveness and facilitating further exploitation. (CVE-2026-43618)

  - Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file
    handling that allows attackers to redirect file writes outside intended directories by replacing parent
    directory components with symbolic links. Attackers with write access to a module path can exploit this
    race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and
    achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only
    be triggered if the chroot setting is false. (CVE-2026-29518)

  - Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's
    hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-
    based deny rules by controlling the PTR record for their source IP address, allowing connections from
    hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
    (CVE-2026-43617)

  - Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls
    including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow
    local attackers to redirect operations to files outside the exported rsync module. Attackers with local
    filesystem access can exploit the timing window between path resolution and syscall execution by swapping
    symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files
    outside the intended module boundary on rsync daemons configured with 'use chroot = no'. (CVE-2026-43619)

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6282 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6282-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     May 20, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : rsync     CVE ID         : CVE-2026-29518 CVE-2026-43617 CVE-2026-43618 CVE-2026-43619                      CVE-2026-43620 CVE-2026-45232

    Several vulnerabilities were discovered in rsync, a fast, versatile,     remote (and local) file-copying tool, which may result in local     privilege escalation, bypass of intended access restrictions, remote     memory disclosure to an authenticated daemon peer or denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 3.2.7-1+deb12u5.

    For the stable distribution (trixie), these problems have been fixed in     version 3.4.1+ds1-5+deb13u3.

    We recommend that you upgrade your rsync packages.

    For the detailed security status of rsync please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/rsync

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the     establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by     sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the     client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a     newline terminator, causing a null byte to be written to an out-of-bounds stack address when the     RSYNC_PROXY environment variable is set. (CVE-2026-45232)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335266	GLSA-202608-03 : rsync: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
333492	EulerOS 2.0 SP11 : rsync (EulerOS-SA-2026-3154)	Nessus	Huawei Local Security Checks	Local	medium
333435	EulerOS 2.0 SP11 : rsync (EulerOS-SA-2026-3100)	Nessus	Huawei Local Security Checks	Local	medium
332898	EulerOS 2.0 SP13 : rsync (EulerOS-SA-2026-2996)	Nessus	Huawei Local Security Checks	Local	medium
332846	EulerOS 2.0 SP13 : rsync (EulerOS-SA-2026-3046)	Nessus	Huawei Local Security Checks	Local	medium
332840	EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)	Nessus	Huawei Local Security Checks	Local	high
332806	EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2948)	Nessus	Huawei Local Security Checks	Local	high
332729	Photon OS 5.0: Rsync PHSA-2026-5.0-91-0885	Nessus	PhotonOS Local Security Checks	Local	high
322854	Fedora 43 : rsync (2026-a04e445b3f)	Nessus	Fedora Local Security Checks	Local	high
321789	Photon OS 5.0: Rsync PHSA-2026-5.0-0885	Nessus	PhotonOS Local Security Checks	Local	high
318271	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : rsync vulnerabilities (USN-8349-1)	Nessus	Ubuntu Local Security Checks	Local	high
317660	SUSE SLES15 Security Update : rsync (SUSE-SU-2026:2083-1)	Nessus	SuSE Local Security Checks	Local	high
316960	SUSE SLED15 / SLES15 Security Update : rsync (SUSE-SU-2026:2038-1)	Nessus	SuSE Local Security Checks	Local	high
316843	SUSE SLES12 Security Update : rsync (SUSE-SU-2026:2048-1)	Nessus	SuSE Local Security Checks	Local	high
316538	FreeBSD : ner/rsync -- multiple vulnerabilities (ecca89eb-54e6-11f1-bc4a-40b034429ecf)	Nessus	FreeBSD Local Security Checks	Local	high
316077	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : rsync vulnerabilities (USN-8283-1)	Nessus	Ubuntu Local Security Checks	Local	high
316074	Slackware Linux 15.0 / current rsync Multiple Vulnerabilities (SSA:2026-141-02)	Nessus	Slackware Local Security Checks	Local	high
442236	Alpine: multiple rrsync packages: security update to 3.4.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
442236	Alpine: multiple rrsync packages: security update to 3.4.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
315779	Debian dsa-6282 : rsync - security update	Nessus	Debian Local Security Checks	Local	high
315598	Linux Distros Unpatched Vulnerability : CVE-2026-45232	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-45232

low

Tenable Plugins

high

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

low