Red Hat Product Errata RHSA-2026:26408 - Security Advisory Issued: 2026-06-16 Updated: 2026-06-16 RHSA-2026:26408 - Security Advisory Overview Updated Packages Synopsis Important: rsync security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding (CVE-2026-43618) rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. (CVE-2026-29518) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2469054 - CVE-2026-43618 rsync: rsync: Remote memory disclosure via integer overflow in compressed-token decoding BZ - 2469055 - CVE-2026-29518 rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot. CVEs CVE-2026-29518 CVE-2026-43618 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 x86_64 rsync-3.1.3-27.el8_10.x86_64.rpm SHA-256: 035fdb2795e3dcebaaf18c89ccdaec6784514e5ad6753afa50d5862ec1a2024a rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.x86_64.rpm SHA-256: 2b39ac69cf0d0e3283474f108493d9bbb8b10da61ea498fd4e83af6471ae60ac rsync-debugsource-3.1.3-27.el8_10.x86_64.rpm SHA-256: 4c7fc8645ad950f30751c145ca306a90dcfec6b155d8cdb8713f7e8740d64812 Red Hat Enterprise Linux for IBM z Systems 8 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 s390x rsync-3.1.3-27.el8_10.s390x.rpm SHA-256: 80e2a6224d170cb7fe2608649f3bad5fe22d658ec0754644227111c8185df8c1 rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.s390x.rpm SHA-256: 538126acb85add3386470d6c4e614414f8e1f4fc8c0f4b4be24cb5867874a093 rsync-debugsource-3.1.3-27.el8_10.s390x.rpm SHA-256: c02e1f18c87f6f536b60b3673cec4d45597fcf4fdbf94c41b9bcad3471f7fb3e Red Hat Enterprise Linux for Power, little endian 8 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 ppc64le rsync-3.1.3-27.el8_10.ppc64le.rpm SHA-256: 344f62d8772fc338bce2cd55e2aa544c03811ff69060b506c6efbae022b733b4 rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.ppc64le.rpm SHA-256: 5b4ef6d2c34d31f74c651b230061773d2deac4d32a8bf8345a73f9c9fcbd984c rsync-debugsource-3.1.3-27.el8_10.ppc64le.rpm SHA-256: 833b29944308c4783e273cfec48bba0b8b8cc13470ab36f5481fe5d64af2c1dc Red Hat Enterprise Linux for ARM 64 8 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 aarch64 rsync-3.1.3-27.el8_10.aarch64.rpm SHA-256: 9266aec010f2300f9dc8e6532d707a406f029be581d6127b5957350d260db7fb rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.aarch64.rpm SHA-256: 2884565ae3191e9b21ac90f22aa69085ab09f250f8a5a20e6b05968da6589009 rsync-debugsource-3.1.3-27.el8_10.aarch64.rpm SHA-256: ae6b255d7ceb17e7c0c1eec02f64eddf502e8327f449ef3063256052c3ad544c Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 x86_64 rsync-3.1.3-27.el8_10.x86_64.rpm SHA-256: 035fdb2795e3dcebaaf18c89ccdaec6784514e5ad6753afa50d5862ec1a2024a rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.x86_64.rpm SHA-256: 2b39ac69cf0d0e3283474f108493d9bbb8b10da61ea498fd4e83af6471ae60ac rsync-debugsource-3.1.3-27.el8_10.x86_64.rpm SHA-256: 4c7fc8645ad950f30751c145ca306a90dcfec6b155d8cdb8713f7e8740d64812 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 aarch64 rsync-3.1.3-27.el8_10.aarch64.rpm SHA-256: 9266aec010f2300f9dc8e6532d707a406f029be581d6127b5957350d260db7fb rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.aarch64.rpm SHA-256: 2884565ae3191e9b21ac90f22aa69085ab09f250f8a5a20e6b05968da6589009 rsync-debugsource-3.1.3-27.el8_10.aarch64.rpm SHA-256: ae6b255d7ceb17e7c0c1eec02f64eddf502e8327f449ef3063256052c3ad544c Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 ppc64le rsync-3.1.3-27.el8_10.ppc64le.rpm SHA-256: 344f62d8772fc338bce2cd55e2aa544c03811ff69060b506c6efbae022b733b4 rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.ppc64le.rpm SHA-256: 5b4ef6d2c34d31f74c651b230061773d2deac4d32a8bf8345a73f9c9fcbd984c rsync-debugsource-3.1.3-27.el8_10.ppc64le.rpm SHA-256: 833b29944308c4783e273cfec48bba0b8b8cc13470ab36f5481fe5d64af2c1dc Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 SRPM rsync-3.1.3-27.el8_10.src.rpm SHA-256: 7f17a6e1ae71fc4fc5027e839551a963eb3d8b6ddcc1447deb2acdb0f97585c3 s390x rsync-3.1.3-27.el8_10.s390x.rpm SHA-256: 80e2a6224d170cb7fe2608649f3bad5fe22d658ec0754644227111c8185df8c1 rsync-daemon-3.1.3-27.el8_10.noarch.rpm SHA-256: 83301559f831586724cac986559c864b7e591ea296dc54de938e728ede52b200 rsync-debuginfo-3.1.3-27.el8_10.s390x.rpm SHA-256: 538126acb85add3386470d6c4e614414f8e1f4fc8c0f4b4be24cb5867874a093 rsync-debugsource-3.1.3-27.el8_10.s390x.rpm SHA-256: c02e1f18c87f6f536b60b3673cec4d45597fcf4fdbf94c41b9bcad3471f7fb3e The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .