The vulnerability in RsyncProject's rsync (versions 3.1.0 up to and including 3.4.4) is an incorrect authorization issue (CWE-863) where the daemon's hostname-based access control evaluation can be bypassed. Specifically, when a DNS resolution for a hostname-based deny rule fails, the daemon does not default to denying access but instead skips the rule. Attackers who can induce DNS resolution failures can exploit this behavior to bypass module-level IP access controls and gain unauthorized access to restricted file trees on the rsync server.

Successful exploitation allows remote attackers to bypass hostname-based deny rules and gain unauthorized access to restricted module file trees on the rsync server. This compromises the access control mechanism intended to restrict access based on hostnames, potentially exposing sensitive data or enabling further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, administrators should consider alternative access control methods that do not rely solely on hostname-based rules or implement network-level protections to mitigate DNS resolution manipulation.