🛡️ CVE-2026-43617 on Alpine — rsync

Distribution advisory

This page covers CVE-2026-43617 as tracked by Alpine, for the package rsync. The fix is available in version 3.4.3-r0; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality low, integrity low, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

• Attack vector: Network — reachable from anywhere that can route to the service.
• Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
• Attack requirements: Present — the target has to be in a particular state for the attack to work.
• Privileges required: None — an unauthenticated stranger can try it.
• User interaction: None — nobody has to be tricked into anything.
• Confidentiality impact: Low — limited, and the attacker does not choose what is affected.
• Integrity impact: Low — limited, and the attacker does not choose what is affected.
• Availability impact: None.

Weakness class

ALPINE-CVE-2026-43617 is classified as CWE-289: Authentication Bypass by Alternate Name. The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

Affected software

ALPINE-CVE-2026-43617 is recorded against 1 package.

• rsync (fixed in 3.4.3-r0)

Timeline and source

Published on 20 May 2026 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

security.alpinelinux.org (Advisory)

Same weakness in other software

These advisories are the same class of weakness (CWE-289: Authentication Bypass by Alternate Name) in other software:

• CVE-2026-8457 (9.8 Critical, published 2 Aug 2026)
• CVE-2026-10842 (7.5 High, published 30 Jul 2026)
• CVE-2026-9701 (9.8 Critical, published 8 Jul 2026)
• CVE-2026-56091 (published 25 Jun 2026)
• CVE-2026-50627 (9.1 Critical, published 12 Jun 2026)
• CVE-2026-44492 (8.0 High, published 29 May 2026)
• CVE-2026-43617 (4.8 Medium, published 20 May 2026)
• CVE-2025-64521 (5.0 Medium, published 16 Apr 2026)

CVE-2026-43617 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References