JLSEC-2026-629

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-629.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-629.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2026-629

Upstream

CVE-2026-43618

EUVD-2026-31011

GHSA-88m5-cm5m-2596

Published

2026-06-25T17:41:14.392Z

Modified

2026-06-25T17:49:19.640447795Z

Severity

6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token...

Details

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.

Database specific

{
    "sources": [
        {
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43618",
            "imported": "2026-06-25T17:27:23.321Z",
            "id": "CVE-2026-43618",
            "modified": "2026-06-17T10:49:55.170Z",
            "published": "2026-05-20T02:16:36.410Z",
            "database_specific": {
                "status": "Analyzed"
            },
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-43618"
        },
        {
            "html_url": "https://github.com/advisories/GHSA-88m5-cm5m-2596",
            "imported": "2026-06-25T17:27:26.723Z",
            "id": "GHSA-88m5-cm5m-2596",
            "modified": "2026-05-20T03:31:40Z",
            "published": "2026-05-20T03:31:33Z",
            "url": "https://api.github.com/advisories/GHSA-88m5-cm5m-2596"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31011",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-31011",
            "id": "EUVD-2026-31011",
            "modified": "2026-05-20T13:04:03Z",
            "published": "2026-05-20T00:50:21Z",
            "imported": "2026-06-25T17:27:24.675Z"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / rsync_jll

Package

Name: rsync_jll
Purl: pkg:julia/rsync_jll?uuid=191d6b87-264a-55f5-a0e2-c8fbce9a1ce0

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.4.4+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-629.json"