debian/csync2 vulnerabilities

Latest debian/csync2 CVEs

Newest publication first

1. CVE-2026-41051 csync2 uses insecure temporary directories when compiled with C99 or later

   Published 2026-05-13

   Medium·CVSS 5.1 EPSS 0.08%

   csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.

2. DLA-2515-1 csync2 - security update

   Published 2021-01-04

   Unknown

3. CVE-2019-15523 An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this func...

   Published 2020-12-30

   Medium·CVSS 5.3

   An issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return value GNUTLS_E_WARNING_ALERT_RECEIVED of the gnutls_handshake() function. It neglects to call this function again, as required by the design of the API.

4. CVE-2019-15522 An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.

   Published 2020-03-20

   Critical·CVSS 9.8

   An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a hello command when the configuration requires use of SSL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.