rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)

What to do

1. Check versions with rsync --version (3.4.0+ reports protocol version 32) or your package manager, on servers, containers and appliances.
2. Update to your distro's patched rsync package, or upstream 3.5.1, which also includes the later 2026 security releases.
3. If a daemon cannot be updated immediately, rebuild with -DDISABLE_SHA512_DIGEST and -DDISABLE_SHA256_DIGEST (mitigates CVE-2024-12084) and -ftrivial-auto-var-init=zero (CVE-2024-12085), or firewall TCP 873 to trusted clients.
4. Avoid pulling from rsync servers you do not trust until clients are patched; the file-read and path-traversal bugs are server-to-client.
5. Review rsyncd.conf modules for anonymous access you do not need.

How to check if you are affected or compromised

• Scan your address space for open TCP 873 and record the protocol version each daemon announces (protocol 32+ indicates 3.4.0 or later).
• Look for rsync daemon crashes or segfaults in system logs, which could indicate attempts against the heap overflow.
• On clients that synced from untrusted servers, look for unexpected files written outside the destination directory (for example in home directories or cron paths).

What happened#

On January 14, 2025, the rsync project released 3.4.0. The GitHub release is timestamped January 14, while the project's NEWS file dates it January 15. The release fixed six vulnerabilities, coordinated through CERT/CC VU#952657. Simon Scannell, Pedro Gallegos and Jasiel Spelman of Google Cloud Vulnerability Research found five of them. Aleksei Gorban found the sixth. Per the oss-security disclosure:

• CVE-2024-12084 (CVSS 9.8): a heap buffer overflow in the daemon's checksum parsing, caused by attacker-controlled checksum lengths. It affects 3.2.7 up to 3.4.0. See also the GitHub advisory.
• CVE-2024-12085 (7.5): uninitialized stack memory leaks one byte at a time, which defeats ASLR.
• CVE-2024-12086 (6.1): a malicious server can reconstruct arbitrary client files.
• CVE-2024-12087 (6.5) and CVE-2024-12088 (6.5): a malicious server can make a client write files outside the destination, via --inc-recursive or a --safe-links bypass.
• CVE-2024-12747 (5.6): a local symlink race condition.

Chained together, 12084 and 12085 let a client run code on an rsync daemon with only anonymous read access, the setup used by public mirrors.

Who is affected#

Every rsync before 3.4.0 has at least some of these bugs. The daemon RCE needs 3.2.7 or later and a reachable rsync:// service on TCP 873. The file-read and file-write bugs reverse the usual direction: they hit clients that connect to a malicious or compromised server. CERT notes that some vendors were not affected by 12084 in their builds, Red Hat and AlmaLinux 8/9 among them, because of how they compiled rsync. Always check your vendor's advisory, not just the version string. rsync 3.4.1, released January 16, 2025, fixed regressions introduced by 3.4.0.

Do you really need to act?#

For most systems in October 2026, no emergency. Distros backported fixes in January 2025. The CVEs are not in CISA KEV as of the October 21, 2026 snapshot, and our sources report no in-the-wild exploitation. The RCE also takes real work: an info leak to beat ASLR, followed by a heap overflow. If you only use rsync over SSH between your own machines, the realistic attacker would already need a foothold on one of them.

The people who should check are those running public or semi-public rsync daemons, and pipelines that pull from third-party mirrors. One more factor matters for them. The project's NEWS file shows that rsync later shipped 3.4.3 (six CVEs, May 2026) and 3.5.0 (33 security issues, August 2026). Being "on 3.4.0" is no longer enough for an exposed daemon.

What to do now#

1. Inventory with rsync --version or dpkg -l rsync / rpm -q rsync. Patched upstream builds report protocol version 32.
2. Install your distro's current rsync package. If you build from source, use upstream 3.5.1.
3. If a daemon must wait, rebuild with -DDISABLE_SHA512_DIGEST -DDISABLE_SHA256_DIGEST and -ftrivial-auto-var-init=zero, or restrict TCP 873 to known clients.
4. Remove anonymous modules you don't need from rsyncd.conf.
5. Until clients are patched, don't sync from servers you don't control.

How to tell if you were hit#

We know of no public indicators of compromise for this set. Check daemon hosts for rsync segfaults or crash loops in the journal, and for unexpected processes or outbound connections from the rsync user. On clients that pulled from untrusted servers, look for files written outside the target directory, such as dotfiles, authorized_keys or cron entries. If a public daemon ran a vulnerable version, an image-level integrity check (package verification with rpm -Va or debsums) is a reasonable first sweep.

Timeline#

• Nov 25, 2024 — CERT/CC notifies vendors.
• Jan 14, 2025 — Public disclosure; rsync 3.4.0 released.
• Jan 16, 2025 — rsync 3.4.1 fixes 3.4.0 regressions.
• May 20, 2026 — rsync 3.4.3 fixes six further CVEs.
• Aug 13, 2026 — rsync 3.5.0 fixes 33 security issues.
• Sep 21, 2026 — rsync 3.5.1 fixes 3.5.0 regressions.

Vulnerability records

• CVE-2024-12084 · A heap-based buffer overflow flaw was found in the rsync daemon.
• CVE-2024-12085 · A flaw was found in rsync which could be triggered when rsync compares file checksums.
• CVE-2024-12086 · A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine.
• CVE-2024-12087 · A path traversal vulnerability exists in rsync.
• CVE-2024-12088 · A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server…
• CVE-2024-12747 · A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CERT/CC — VU#952657: Rsync contains six vulnerabilities kb.cert.org
2. oss-security — rsync: multiple vulnerabilities (Jan 14, 2025) openwall.com
3. GitHub Advisory — CVE-2024-12084 (GHSA-85h7-m8c3-v9wc) github.com
4. rsync project — NEWS (3.4.0 through 3.5.1) download.samba.org
5. RsyncProject — rsync v3.4.0 release github.com