CVE-2024-12086: Rsync: rsync server leaks arbitrary client…

Should you act?

Normal patch cycle

No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
EPSS 1.8%, percentile 78: FIRST’s model estimates a 1.8% chance of exploitation activity in the next 30 days, higher than 78% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
Editorial verdict: Check exposure. rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084) — Distros shipped fixes in January 2025 and there is no known exploitation, but internet-facing rsync daemons have since needed two more security releases, so verify you run a current rsync rather than just 3.4.0.

What it is

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

Weakness type: CWE-390.

Product: rsync · Assigned by: redhat · Published: 2025-01-14

Affected and fixed versions

Vendor	Product	Affected versions (per CVE record)
	rsync	<= 3.3.0
Red Hat	Red Hat Enterprise Linux 10	see vendor advisory
Red Hat	Red Hat Enterprise Linux 9	see vendor advisory
Red Hat	Red Hat Enterprise Linux 9	see vendor advisory
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see vendor advisory
Red Hat	Red Hat Discovery 2	see vendor advisory
Red Hat	Red Hat Enterprise Linux 6	see vendor advisory
Red Hat	Red Hat Enterprise Linux 7	see vendor advisory
Red Hat	Red Hat Enterprise Linux 8	see vendor advisory
Red Hat	Red Hat OpenShift Container Platform 4	see vendor advisory

Severity scores

Scored by	CVSS	Score	Vector
redhat	3.1	6.1 Medium	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N`

Attack vector: network (remotely reachable)
Attack complexity: high (needs special conditions)
Privileges required: none (no login)
User interaction: required (a user must click/open something)
Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
CISA SSVC assessment: exploitation poc, automatable no, technical impact partial.
FIRST EPSS (model of 2026-10-21): 1.79% probability of exploitation activity in the next 30 days; percentile 78.

Timeline

2025-01-14 — CVE record published by redhat
2025-01-14 — erroneo.us brief: rsync: Six Flaws Incl. Daemon Heap Overflow (CVE-2024-12084)
2026-08-21 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

RHBA-2025:6470 access.redhat.com
RHSA-2026:19368 access.redhat.com
RHSA-2026:20603 access.redhat.com
RHSA-2026:29197 access.redhat.com

Vulnerability records

CVE.org record CVE-2024-12086 cve.org
NVD entry CVE-2024-12086 nvd.nist.gov

Other references from the CVE record and advisory

access.redhat.com access.redhat.com
RHBZ#2330577 bugzilla.redhat.com
kb.cert.org kb.cert.org
github.com github.com
security.netapp.com security.netapp.com
lists.debian.org lists.debian.org
kb.cert.org kb.cert.org

Today’s Security Digest