rsync 3.4.3 patches six CVEs, two reachable without daemon mode
rsync 3.4.3 fixes six CVEs released May 20. CVE-2026-43618 (CVSS 8.1) leaks client memory from any pull against a malicious server -- no daemon config required.
Cve 2026 43619
1 article tagged #cve-2026-43619