---
title: "rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)"
url: https://erroneo.us/security/briefs/rsync-heap-overflow-cve-2024-12084/
description: "rsync before 3.4.0: daemon RCE with anonymous read access, plus malicious-server file read/write bugs. Fixed in 3.4.0; run 3.5.1 today. Verdict: check exposure."
type: security-brief
section: "Security Digest"
date_published: 2025-01-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-12084", "CVE-2024-12085", "CVE-2024-12086", "CVE-2024-12087", "CVE-2024-12088", "CVE-2024-12747"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)

**Verdict: Check exposure.** Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0.

- **Who must act:** Operators of rsync daemons (rsyncd, TCP 873), especially public mirrors with anonymous read access, and anyone who pulls from untrusted rsync servers.
- **Who can relax:** Hosts that only use rsync over SSH between machines you control, with distro-patched packages, face little practical risk from this set.
- **Affected:** rsync 3.2.7 to before 3.4.0 (CVE-2024-12084); rsync before 3.4.0 (CVE-2024-12085, -12086, -12087, -12088, -12747)
- **Fixed:** rsync 3.4.0 (3.4.1 fixes 3.4.0 regressions); Distribution backports of the above
- **CVEs:** CVE-2024-12084, CVE-2024-12085, CVE-2024-12086, CVE-2024-12087, CVE-2024-12088, CVE-2024-12747
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Check versions with rsync --version (3.4.0+ reports protocol version 32) or your package manager, on servers, containers and appliances.
2. Update to your distro's patched rsync package, or upstream 3.5.1, which also includes the later 2026 security releases.
3. If a daemon cannot be updated immediately, rebuild with -DDISABLE_SHA512_DIGEST and -DDISABLE_SHA256_DIGEST (mitigates CVE-2024-12084) and -ftrivial-auto-var-init=zero (CVE-2024-12085), or firewall TCP 873 to trusted clients.
4. Avoid pulling from rsync servers you do not trust until clients are patched; the file-read and path-traversal bugs are server-to-client.
5. Review rsyncd.conf modules for anonymous access you do not need.

### How to check if you are affected

- Scan your address space for open TCP 873 and record the protocol version each daemon announces (protocol 32+ indicates 3.4.0 or later).
- Look for rsync daemon crashes or segfaults in system logs, which could indicate attempts against the heap overflow.
- On clients that synced from untrusted servers, look for unexpected files written outside the destination directory (for example in home directories or cron paths).

## What happened

On January 14, 2025, the rsync project released 3.4.0. The [GitHub release](https://github.com/RsyncProject/rsync/releases/tag/v3.4.0) is timestamped January 14, while the project's NEWS file dates it January 15. The release fixed six vulnerabilities, coordinated through [CERT/CC VU#952657](https://kb.cert.org/vuls/id/952657). Simon Scannell, Pedro Gallegos and Jasiel Spelman of Google Cloud Vulnerability Research found five of them. Aleksei Gorban found the sixth. Per the [oss-security disclosure](https://www.openwall.com/lists/oss-security/2025/01/14/3):

- **CVE-2024-12084** (CVSS 9.8): a heap buffer overflow in the daemon's checksum parsing, caused by attacker-controlled checksum lengths. It affects 3.2.7 up to 3.4.0. See also the [GitHub advisory](https://github.com/advisories/GHSA-85h7-m8c3-v9wc).
- **CVE-2024-12085** (7.5): uninitialized stack memory leaks one byte at a time, which defeats ASLR.
- **CVE-2024-12086** (6.1): a malicious server can reconstruct arbitrary client files.
- **CVE-2024-12087** (6.5) and **CVE-2024-12088** (6.5): a malicious server can make a client write files outside the destination, via `--inc-recursive` or a `--safe-links` bypass.
- **CVE-2024-12747** (5.6): a local symlink race condition.

Chained together, 12084 and 12085 let a client run code on an rsync daemon with only anonymous read access, the setup used by public mirrors.

## Who is affected

Every rsync before 3.4.0 has at least some of these bugs. The daemon RCE needs 3.2.7 or later and a reachable `rsync://` service on TCP 873. The file-read and file-write bugs reverse the usual direction: they hit *clients* that connect to a malicious or compromised server. CERT notes that some vendors were not affected by 12084 in their builds, Red Hat and AlmaLinux 8/9 among them, because of how they compiled rsync. Always check your vendor's advisory, not just the version string. rsync 3.4.1, released January 16, 2025, fixed regressions introduced by 3.4.0.

## Do you really need to act?

For most systems in October 2026, no emergency. Distros backported fixes in January 2025. The CVEs are not in CISA KEV as of the October 21, 2026 snapshot, and our sources report no in-the-wild exploitation. The RCE also takes real work: an info leak to beat ASLR, followed by a heap overflow. If you only use rsync over SSH between your own machines, the realistic attacker would already need a foothold on one of them.

The people who should check are those running public or semi-public rsync daemons, and pipelines that pull from third-party mirrors. One more factor matters for them. The project's [NEWS file](https://download.samba.org/pub/rsync/NEWS) shows that rsync later shipped 3.4.3 (six CVEs, May 2026) and 3.5.0 (33 security issues, August 2026). Being "on 3.4.0" is no longer enough for an exposed daemon.

## What to do now

1. Inventory with `rsync --version` or `dpkg -l rsync` / `rpm -q rsync`. Patched upstream builds report protocol version 32.
2. Install your distro's current rsync package. If you build from source, use upstream 3.5.1.
3. If a daemon must wait, rebuild with `-DDISABLE_SHA512_DIGEST -DDISABLE_SHA256_DIGEST` and `-ftrivial-auto-var-init=zero`, or restrict TCP 873 to known clients.
4. Remove anonymous modules you don't need from `rsyncd.conf`.
5. Until clients are patched, don't sync from servers you don't control.

## How to tell if you were hit

We know of no public indicators of compromise for this set. Check daemon hosts for rsync segfaults or crash loops in the journal, and for unexpected processes or outbound connections from the rsync user. On clients that pulled from untrusted servers, look for files written outside the target directory, such as dotfiles, `authorized_keys` or cron entries. If a public daemon ran a vulnerable version, an image-level integrity check (package verification with `rpm -Va` or `debsums`) is a reasonable first sweep.

## Timeline

- Nov 25, 2024 — CERT/CC notifies vendors.
- Jan 14, 2025 — Public disclosure; rsync 3.4.0 released.
- Jan 16, 2025 — rsync 3.4.1 fixes 3.4.0 regressions.
- May 20, 2026 — rsync 3.4.3 fixes six further CVEs.
- Aug 13, 2026 — rsync 3.5.0 fixes 33 security issues.
- Sep 21, 2026 — rsync 3.5.1 fixes 3.5.0 regressions.

## Sources

1. [CERT/CC — VU#952657: Rsync contains six vulnerabilities](https://kb.cert.org/vuls/id/952657)
2. [oss-security — rsync: multiple vulnerabilities (Jan 14, 2025)](https://www.openwall.com/lists/oss-security/2025/01/14/3)
3. [GitHub Advisory — CVE-2024-12084 (GHSA-85h7-m8c3-v9wc)](https://github.com/advisories/GHSA-85h7-m8c3-v9wc)
4. [rsync project — NEWS (3.4.0 through 3.5.1)](https://download.samba.org/pub/rsync/NEWS)
5. [RsyncProject — rsync v3.4.0 release](https://github.com/RsyncProject/rsync/releases/tag/v3.4.0)

---
Source page: https://erroneo.us/security/briefs/rsync-heap-overflow-cve-2024-12084/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt