An update for rsync is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2551 Final 1.0 1.0 2026-06-05 Initial 2026-06-05 2026-06-05 openEuler SA Tool V1.0 2026-06-05 rsync security update An update for rsync is now available for openEuler-22.03-LTS-SP4 Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es): Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620) An update for rsync is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium rsync https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2551 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-43620 https://nvd.nist.gov/vuln/detail/CVE-2026-43620 openEuler-22.03-LTS-SP4 rsync-3.2.5-8.oe2203sp4.aarch64.rpm rsync-debuginfo-3.2.5-8.oe2203sp4.aarch64.rpm rsync-debugsource-3.2.5-8.oe2203sp4.aarch64.rpm rsync-3.2.5-8.oe2203sp4.src.rpm rsync-3.2.5-8.oe2203sp4.x86_64.rpm rsync-debuginfo-3.2.5-8.oe2203sp4.x86_64.rpm rsync-debugsource-3.2.5-8.oe2203sp4.x86_64.rpm rsync-help-3.2.5-8.oe2203sp4.noarch.rpm Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client. 2026-06-05 CVE-2026-43620 openEuler-22.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H rsync security update 2026-06-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2551