---
id: CVE-2024-12086
title: A flaw was found in rsync
summary: >-
  A flaw was found in rsync. It could allow a server to enumerate the contents
  of an arbitrary file from the client's machine. This issue occurs when files
  are being copied from a client to a server. During this process, the rsync
  server w…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N'
cwe:
  - CWE-390
vendor: samba
product: rsync
affected:
  - rsync <= 3.3.0
  - openshift_container_platform = 4.0
  - enterprise_linux = 6.0
  - enterprise_linux = 7.0
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
  - enterprise_linux = 10.0
  - almalinux = 8.0
  - almalinux = 9.0
  - almalinux = 10.0
  - arch_linux
  - linux
  - nixos < 24.11
  - suse_linux
  - smartos < 20250123
patched:
  - nixos 24.11
  - smartos 20250123
published: '2025-01-14'
updated: '2026-06-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-12086'
references:
  - url: 'https://access.redhat.com/errata/RHBA-2025:6470'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:19368'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:20603'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:29197'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/security/cve/CVE-2024-12086'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2330577'
    label: secalert@redhat.com
  - url: 'https://kb.cert.org/vuls/id/952657'
    label: secalert@redhat.com
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250131-0002/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/952657'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqj
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.01827
epssPercentile: 0.77967
ingestedAt: '2026-06-29T13:24:34.146Z'
---

## Overview

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

## Affected

- `rsync <= 3.3.0`
- `openshift_container_platform = 4.0`
- `enterprise_linux = 6.0`
- `enterprise_linux = 7.0`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`
- `enterprise_linux = 10.0`
- `almalinux = 8.0`
- `almalinux = 9.0`
- `almalinux = 10.0`
- `arch_linux`
- `linux`
- `nixos < 24.11`
- `suse_linux`
- `smartos < 20250123`

## Remediation

Upgrade past the affected range:

- `nixos 24.11`
- `smartos 20250123`