Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver's compressed-token decoder accumulated a 32-bit signed counter without checking for overflow. A malicious sender can trigger an overflow that with careful manipulation can lead to the extraction of data stored in memory of the process allowing an attacker to access environment variables, passwords and memory pointers from the heap, stack, and libraries. The leakage of these pointers and data can significantly reduce the effectiveness of ASLR and facilitate further exploitation. This issue is fixed in version 3.4.3.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-44508 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate.
CVE-2026-44508
✕ Withdrawn — historical dataHIGHPre-NVD 8.1
8.1CVSS
- CVSS v3
- 8.1
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
July 20, 2026
Last Modified
July 20, 2026
References (1)
- security-advisories@githubhttps://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq
Frequently asked(4)
What is CVE-2026-44508?
CVE-2026-44508 is a rejected CVE ID: its record was withdrawn on July 21, 2026 and no longer describes a vulnerability. Reason given: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate. Its record names CVE-2026-43618 as the replacement.
When was the CVE record for CVE-2026-44508 published?
The CVE record for CVE-2026-44508 was published on July 20, 2026. EchelonGraph's copy of the record carries a last-modified date of July 20, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-44508?
CVE-2026-44508 has a CVSS base score of 8.1 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-44508?
There is nothing to remediate under CVE-2026-44508: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability. Its record names CVE-2026-43618 as the replacement; act on that CVE instead.