Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open() calls missed races in other path based system calls like chmod() and chown(). For rsync daemons with "use chroot = no" this allows an attacker with local filesystem access to change permissions, ownership or timestamp on a file outside the exported module. This issue is fixed in version 3.4.3.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-44509 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate.
CVE-2026-44509
✕ Withdrawn — historical dataMEDIUMPre-NVD 6.3
6.3CVSS
- CVSS v3
- 6.3
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
July 20, 2026
Last Modified
July 21, 2026
References (1)
- security-advisories@githubhttps://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735
Frequently asked(4)
What is CVE-2026-44509?
CVE-2026-44509 is a rejected CVE ID: its record was withdrawn on July 21, 2026 and no longer describes a vulnerability. Reason given: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason: This candidate is a duplicate of CVE-2026-43619. Notes: All CVE users should reference CVE-2026-43619 instead of this candidate. Its record names CVE-2026-43619 as the replacement.
When was the CVE record for CVE-2026-44509 published?
The CVE record for CVE-2026-44509 was published on July 20, 2026. EchelonGraph's copy of the record carries a last-modified date of July 21, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-44509?
CVE-2026-44509 has a CVSS base score of 6.3 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-44509?
There is nothing to remediate under CVE-2026-44509: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability. Its record names CVE-2026-43619 as the replacement; act on that CVE instead.