What is CVE-2026-44509?

CVE-2026-44509 is a medium-severity vulnerability in Rsyncproject Rsync, classified under Improper Link Resolution Before File Access. CVSS score: 6.3/10. Published 2026-07-20.

How severe is CVE-2026-44509?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Auth bypass in Rsyncproject Rsync

CVE-2026-44509

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open() calls missed races in other path based system calls like ch…

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Rsyncproject Rsync — versions < 3.4.3

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access
CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-863 — Incorrect Authorization

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-44509?: CVE-2026-44509 is a medium-severity vulnerability in Rsyncproject Rsync, classified under Improper Link Resolution Before File Access. CVSS score: 6.3/10. Published 2026-07-20.
How severe is CVE-2026-44509?: Medium severity. CVSS v3 base score is 6.3 out of 10.