CVE-2024-12085

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

• CWE-908
• CWE-908

• https://access.redhat.com/errata/RHBA-2025:6470
• https://access.redhat.com/errata/RHSA-2024:6122
• https://access.redhat.com/errata/RHSA-2025:0324Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0325Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0637Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0688Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0714Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0774Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0787Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0790Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0849Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0884Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:0885Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1120Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1123Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1128Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1225Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1227Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1242Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:1451Third Party Advisory
• https://access.redhat.com/errata/RHSA-2025:21885
• https://access.redhat.com/errata/RHSA-2025:2701Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2024-12085Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2330539Issue Tracking, Third Party Advisory
• https://kb.cert.org/vuls/id/952657Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/01/msg00008.html
• https://security.netapp.com/advisory/ntap-20250131-0002/
• https://www.kb.cert.org/vuls/id/952657
• https://github.com/google/security-research/security/advisories/GHSA-p5pg-x43v-mvqjExploit, Third Party Advisory

Published

Jan 14, 2025

Last Modified

Aug 11, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12078ECOVACS robot lawn mowers and vacuums use a shared, static s…6.3
• CVE-2024-12079ECOVACS robot lawnmowers store the anti-theft PIN in clearte…4.8
• CVE-2024-1208The LearnDash LMS plugin for WordPress is vulnerable to Sens…5.3
• CVE-2024-12082in OpenHarmony v4.0.0 and prior versions allow a local attac…5.5
• CVE-2024-12083Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-serie…6.6
• CVE-2024-12084A heap-based buffer overflow flaw was found in the rsync dae…9.8
• CVE-2024-12086A flaw was found in rsync. It could allow a server to enumer…6.8
• CVE-2024-12087A path traversal vulnerability exists in rsync. It stems fro…7.5
• CVE-2024-12088A flaw was found in rsync. When using the `--safe-links` opt…7.5
• CVE-2024-12089A stored Cross-site Scripting (XSS) vulnerability affecting …5.4
• CVE-2024-1209The LearnDash LMS plugin for WordPress is vulnerable to Sens…5.3
• CVE-2024-12090A stored Cross-site Scripting (XSS) vulnerability affecting …5.4