Every CVE Search/ Get API key

CVE-2026-41035

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...

7.4 HighFix available

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.39%Up 0.4 points since Apr 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
CVE-2026-41035
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-130, CWE-805
Updated
2026-11-02
EUVDEUVD-2026-23215 7.4

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
EUVD-2026-23215
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-m34r-4v3r-pp9v 7.4

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
GHSA-m34r-4v3r-pp9v
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-130, CWE-805
Updated
2026-11-02
NVD 7.4

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
CVE-2026-41035
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-130, CWE-805
Updated
2026-11-02
OSVALPINE-CVE-2026-41035 7.8

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
ALPINE-CVE-2026-41035
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-41035 7.8
Record
BELL-CVE-2026-41035
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 48 moreShow less
OSV 7.4

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
CVE-2026-41035
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-130
Updated
2026-11-02
OSVDEBIAN-CVE-2026-41035 7.8

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
DEBIAN-CVE-2026-41035
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-627 7.8

In rsync 3.0.1 through 3.4.1, `receive_xattr` relies on an untrusted length value during a qsort...

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
JLSEC-2026-627
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2150 7.4

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the "rsync algorithm" which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.(CVE-2026-41035)

Record
OESA-2026-2150
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:17481 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:17481
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:19152 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:19152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:19368 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:19368
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:20601 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:20601
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:20602 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:20602
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:20603 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:20603
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:20604 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:20604
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:20696 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:20696
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:25149 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:25149
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:25170 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:25170
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:25172 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:25172
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:25173 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:25173
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:25190 7.4

Red Hat Security Advisory: rsync security update

Record
RHSA-2026:25190
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:17481 7.4

Important: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:17481
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:19152 7.4

Important: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19152
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:19368 7.4

Important: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync server leaks arbitrary client files (CVE-2024-12086)

  • rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19368
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-41035 7.4

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
UBUNTU-CVE-2026-41035
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:17481 No score

Important: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:17481
Updated
2026-11-02
OSVALSA-2026:19152 No score

Important: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19152
Updated
2026-11-02
OSVALSA-2026:19368 No score

Important: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

  • rsync: rsync server leaks arbitrary client files (CVE-2024-12086)
  • rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:19368
Updated
2026-11-02
OSVAZL-82958 No score

CVE-2026-41035 affecting package rsync for versions less than 3.4.3-1

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Record
AZL-82958
Updated
2026-11-02
OSVCLSA-2026-1778940132 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: receiver use-after-free in receive_xattr via untrusted xattr count passed to qsort
Record
CLSA-2026-1778940132
Updated
2026-11-02
OSVCLSA-2026-1779131668 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: receiver use-after-free in receive_xattr via untrusted xattr count passed to qsort
Record
CLSA-2026-1779131668
Updated
2026-11-02
OSVCLSA-2026-1779154430 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: receiver use-after-free in receive_xattr via untrusted xattr count passed to qsort
Record
CLSA-2026-1779154430
Updated
2026-11-02
OSVCLSA-2026-1780054763 No score

Fix CVE(s): CVE-2026-41035

  • SECURITY UPDATE: use-after-free in receive_xattr()
    • debian/patches/CVE-2026-41035.patch: replace stale local 'count' with temp_xattr.count in the qsort call inside receive_xattr(), so the sort uses the live size of the rebuilt xattr items list; victim must run rsync with -X / --xattrs
    • CVE-2026-41035
Record
CLSA-2026-1780054763
Updated
2026-11-02
OSVCLSA-2026-1780054955 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: fix use-after-free in receive_xattr by using temp_xattr.count instead of the stale count in qsort
Record
CLSA-2026-1780054955
Updated
2026-11-02
OSVCLSA-2026-1780055137 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: fix use-after-free in receive_xattr by using temp_xattr.count instead of the stale count in qsort
Record
CLSA-2026-1780055137
Updated
2026-11-02
OSVCLSA-2026-1780062116 No score

Fix CVE(s): CVE-2026-41035

  • SECURITY UPDATE: use-after-free in receive_xattr()
    • debian/patches/CVE-2026-41035.patch: replace stale local 'count' with temp_xattr.count in the qsort call inside receive_xattr(), so the sort uses the live size of the rebuilt xattr items list; victim must run rsync with -X / --xattrs
    • CVE-2026-41035
Record
CLSA-2026-1780062116
Updated
2026-11-02
OSVCLSA-2026-1780062671 No score

Fix CVE(s): CVE-2026-41035

  • SECURITY UPDATE: receiver use-after-free in receive_xattr() via a wire-supplied xattr count passed to qsort():
    • debian/patches/els/0007-CVE-2026-41035.patch: sort temp_xattr.count stored items instead of the untrusted wire count.
    • CVE-2026-41035.
Record
CLSA-2026-1780062671
Updated
2026-11-02
OSVCLSA-2026-1780064425 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: fix use of wrong element count in qsort call in receive_xattr() leading to SIGSEGV
Record
CLSA-2026-1780064425
Updated
2026-11-02
OSVCLSA-2026-1780066764 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: fix use-after-free in receive_xattr() caused by qsort() being called with a stale local 'count' variable instead of the live temp_xattr.count after the rxa list was rebuilt; victim runs rsync with -X / --xattrs (lifted verbatim from upstream rsync 968d4c0c)
Record
CLSA-2026-1780066764
Updated
2026-11-02
OSVCLSA-2026-1780388397 No score

rsync: Fix of 3 CVEs

  • CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count
Record
CLSA-2026-1780388397
Updated
2026-11-02
OSVCLSA-2026-1780388593 No score

rsync: Fix of 2 CVEs

  • CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count
Record
CLSA-2026-1780388593
Updated
2026-11-02
OSVCLSA-2026-1780389337 No score

rsync: Fix of CVE-2026-41035

  • CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count
Record
CLSA-2026-1780389337
Updated
2026-11-02
OSVCLSA-2026-1782739272 No score

Fix CVE(s): CVE-2026-29518, CVE-2026-41035

  • PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050)
    • the daemon's compile-time NOBODY_GROUP was resolved to "nobody" by the focal build chroot's /etc/group, but stock Ubuntu/Debian have only "nogroup", so daemon modules with no explicit gid were rejected with "@ERROR: invalid gid nobody" (test_daemon / ELSR-8050)
    • debian/rules: build with rsync's own --with-nobody-group=nogroup configure option so the compile-time NOBODY_GROUP default is baked as "nogroup" regardless of the build chroot, matching the stock Ubuntu/Debian rsync build (fixes modules with no explicit gid)
    • debian/patches/rsync-daemon-nobody-group-fallback.patch: in the daemon's add_a_group() resolve a "nobody" group to "nogroup" at runtime when the host has no "nobody" group, so a module that explicitly sets "gid = nobody" is also honoured on stock Ubuntu/Debian instead of being rejected with "@ERROR: invalid gid nobody"; any other unresolvable group is still rejected
    • upstream: configure.ac AC_ARG_WITH(nobody-group) https://github.com/RsyncProject/rsync/blob/v3.1.3/configure.ac#L142-L157 Debian bugs #144570 (https://bugs.debian.org/144570) and #25299
    • ELSR-8050
Record
CLSA-2026-1782739272
Updated
2026-11-02
OSVMGASA-2026-0101 No score

Updated rsync packages fix security vulnerability

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable. (CVE-2026-41035)

Record
MGASA-2026-0101
Updated
2026-11-02
OSVopenSUSE-SU-2026:10775-1 No score

rsync-3.4.1-5.1 on GA media

These are all security issues fixed in the rsync-3.4.1-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10775-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20754-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
Record
openSUSE-SU-2026:20754-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20877-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
openSUSE-SU-2026:20877-1
Updated
2026-11-02
OSVSUSE-SU-2026:2002-1 No score

Security update for rsync

This update for rsync fixes the following issue

  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
Record
SUSE-SU-2026:2002-1
Updated
2026-11-02
OSVSUSE-SU-2026:2038-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2038-1
Updated
2026-11-02
OSVSUSE-SU-2026:2048-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2048-1
Updated
2026-11-02
OSVSUSE-SU-2026:2083-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2083-1
Updated
2026-11-02
OSVSUSE-SU-2026:21676-1 No score

Security update for rsync

This update for rsync fixes the following issue

  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
Record
SUSE-SU-2026:21676-1
Updated
2026-11-02

Affected products

Show 15 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
rsync
Alpine:v3.20
 3.0.1 up to 3.4.1-r2
3.4.1-r2
rsync
Alpine:v3.21
 3.0.1 up to 3.4.1-r2
3.4.1-r2
rsync
Alpine:v3.22
 3.0.1 up to 3.4.1-r2
3.4.1-r2
rsync
Alpine:v3.23
 3.0.1 up to 3.4.1-r2
3.4.1-r2
rsync
Alpine:v3.24
 3.0.1 up to 3.4.1-r2
3.4.1-r2
rsync
AlmaLinux:8
 before 3.1.3-25.el8_10
3.1.3-25.el8_10
rsync-daemon
AlmaLinux:8
 before 3.1.3-25.el8_10
3.1.3-25.el8_10
rsync
AlmaLinux:10
 before 3.4.1-6.el10_2
3.4.1-6.el10_2
rsync-daemon
AlmaLinux:10
 before 3.4.1-6.el10_2
3.4.1-6.el10_2
rsync-rrsync
AlmaLinux:10
 before 3.4.1-6.el10_2
3.4.1-6.el10_2
Show 96 moreShow less
Affected packages
PackageAffectedFixed
rsync
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.2.5-7.el9_8
3.2.5-7.el9_8
rsync-daemon
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.2.5-7.el9_8
3.2.5-7.el9_8
rsync-rrsync
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.2.5-7.el9_8
3.2.5-7.el9_8
rsync
Azure Linux:3
 before 3.4.3-1
3.4.3-1
rsync
Alpaquita:23
 3.2.7-r0 up to 3.2.7-r3
3.2.7-r3
rsync
Alpaquita:25
 3.4.1-r0 up to 3.4.1-r2
3.4.1-r2
rsync
Alpaquita:stream
 3.2.5-r0 up to 3.4.1-r2
3.4.1-r2
rsync
TuxCare:CentOS-Stream:8
 before 3.1.3-19.el8.1.tuxcare.els6
3.1.3-19.el8.1.tuxcare.els6
rsync-daemon
TuxCare:CentOS-Stream:8
 before 3.1.3-19.el8.1.tuxcare.els6
3.1.3-19.el8.1.tuxcare.els6
rsync
TuxCare:CentOS:8.5
 before 3.1.3-12.el8.tuxcare.els9
3.1.3-12.el8.tuxcare.els9
rsync-daemon
TuxCare:CentOS:8.5
 before 3.1.3-12.el8.tuxcare.els9
3.1.3-12.el8.tuxcare.els9
rsync
TuxCare:CentOS:8.4
 before 3.1.3-12.el8.tuxcare.els9
3.1.3-12.el8.tuxcare.els9
rsync-daemon
TuxCare:CentOS:8.4
 before 3.1.3-12.el8.tuxcare.els9
3.1.3-12.el8.tuxcare.els9
rsync
TuxCare:Ubuntu:18.04
 before 3.1.2-2.1ubuntu1.6+tuxcare.els8
3.1.2-2.1ubuntu1.6+tuxcare.els8
rsync
TuxCare:OracleLinux:6
 before 3.0.6-12.el6.tuxcare.els9
3.0.6-12.el6.tuxcare.els9
rsync
TuxCare:CentOS:6
 before 3.0.6-12.el6.tuxcare.els9
3.0.6-12.el6.tuxcare.els9
rsync
TuxCare:Ubuntu:16.04
 before 3.1.1-3ubuntu1.3+tuxcare.els10
3.1.1-3ubuntu1.3+tuxcare.els10
rsync
TuxCare:Debian:10
 before 3.1.3-6+tuxcare.els3
3.1.3-6+tuxcare.els3
rsync
TuxCare:AlmaLinux:9.2
 before 3.2.3-19.el9_2.tuxcare.els7
3.2.3-19.el9_2.tuxcare.els7
rsync-daemon
TuxCare:AlmaLinux:9.2
 before 3.2.3-19.el9_2.tuxcare.els7
3.2.3-19.el9_2.tuxcare.els7
rsync
TuxCare:AlmaLinux:9.6
 before 3.2.5-3.el9_6.tuxcare.els7
3.2.5-3.el9_6.tuxcare.els7
rsync-daemon
TuxCare:AlmaLinux:9.6
 before 3.2.5-3.el9_6.tuxcare.els7
3.2.5-3.el9_6.tuxcare.els7
rsync-rrsync
TuxCare:AlmaLinux:9.6
 before 3.2.5-3.el9_6.tuxcare.els7
3.2.5-3.el9_6.tuxcare.els7
rsync
TuxCare:RHEL:7
 before 3.1.2-12.0.1.el7_9.tuxcare.els8
3.1.2-12.0.1.el7_9.tuxcare.els8
rsync
TuxCare:OracleLinux:7
 before 3.1.2-12.0.1.el7_9.tuxcare.els8
3.1.2-12.0.1.el7_9.tuxcare.els8
rsync
TuxCare:CentOS:7
 before 3.1.2-12.0.1.el7_9.tuxcare.els8
3.1.2-12.0.1.el7_9.tuxcare.els8
rsync
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 3.1.3-8ubuntu0.9+tuxcare.els4
3.1.3-8ubuntu0.9+tuxcare.els4
rsync
Debian:12
 before 3.2.7-1+deb12u5, plus listed versions
3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u33.2.7-1+deb12u4
3.2.7-1+deb12u5
rsync
Debian:13
 before 3.4.1+ds1-5+deb13u2, plus listed versions
3.4.1+ds1-53.4.1+ds1-5+deb13u1
3.4.1+ds1-5+deb13u2
rsync
Debian:14
 before 3.4.2+ds1-1, plus listed versions
3.4.1+ds1-53.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp1
3.4.2+ds1-1
rsync_jll
Julia
 before 3.4.4+0
3.4.4+0
rsync
Mageia:9
 before 3.2.7-1.4.mga9
3.2.7-1.4.mga9
rsync
openEuler:20.03-LTS-SP4
 before 3.1.3-13.oe2003sp4
3.1.3-13.oe2003sp4
rsync
openEuler:22.03-LTS-SP4
 before 3.2.5-6.oe2203sp4
3.2.5-6.oe2203sp4
rsync
openEuler:24.03-LTS
 before 3.2.7-8.oe2403sp3
3.2.7-8.oe2403sp3
rsync
openEuler:24.03-LTS-SP1
 before 3.2.7-8.oe2403sp1
3.2.7-8.oe2403sp1
rsync
openEuler:24.03-LTS-SP3
 before 3.2.7-8.oe2403sp3
3.2.7-8.oe2403sp3
rsync
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-25.el8_10
0:3.1.3-25.el8_10
rsync-daemon
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-25.el8_10
0:3.1.3-25.el8_10
rsync-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-25.el8_10
0:3.1.3-25.el8_10
rsync-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:3.1.3-25.el8_10
0:3.1.3-25.el8_10
rsync-daemon
Red Hat:enterprise_linux:10.2
 before 0:3.4.1-6.el10_2
0:3.4.1-6.el10_2
rsync-rrsync
Red Hat:enterprise_linux:10.2
 before 0:3.4.1-6.el10_2
0:3.4.1-6.el10_2
rsync
Red Hat:enterprise_linux:10.2
 before 0:3.4.1-6.el10_2
0:3.4.1-6.el10_2
rsync-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:3.4.1-6.el10_2
0:3.4.1-6.el10_2
rsync-debugsource
Red Hat:enterprise_linux:10.2
 before 0:3.4.1-6.el10_2
0:3.4.1-6.el10_2
rsync-daemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.2.5-7.el9_8
0:3.2.5-7.el9_8
rsync-rrsync
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.2.5-7.el9_8
0:3.2.5-7.el9_8
rsync
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:3.2.5-7.el9_8
0:3.2.5-7.el9_8
rsync-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:3.2.5-7.el9_8
0:3.2.5-7.el9_8
rsync-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 2 CVEs
 before 0:3.2.5-7.el9_8
0:3.2.5-7.el9_8
rsync-daemon
Red Hat:rhel_e4s:9.0::appstream
 before 0:3.2.3-9.el9_0.5
0:3.2.3-9.el9_0.5
rsync
Red Hat:rhel_e4s:9.0::baseos
 before 0:3.2.3-9.el9_0.5
0:3.2.3-9.el9_0.5
rsync-daemon
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 0:3.2.3-19.el9_2.3
0:3.2.3-19.el9_2.3
rsync
Red Hat:rhel_e4s:9.2::baseos
From an advisory covering 2 CVEs
 before 0:3.2.3-19.el9_2.3
0:3.2.3-19.el9_2.3
rsync-daemon
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 3 CVEs
 before 0:3.2.5-3.el9_6.1
0:3.2.5-3.el9_6.1
rsync
Red Hat:rhel_eus:9.6::baseos
From an advisory covering 3 CVEs
 before 0:3.2.5-3.el9_6.1
0:3.2.5-3.el9_6.1
rsync-daemon
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 0:3.2.3-19.el9_4.3
0:3.2.3-19.el9_4.3
rsync
Red Hat:rhel_eus:9.4::baseos
From an advisory covering 2 CVEs
 before 0:3.2.3-19.el9_4.3
0:3.2.3-19.el9_4.3
rsync-daemon
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.4.1-2.el10_0.2
0:3.4.1-2.el10_0.2
rsync
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 0:3.4.1-2.el10_0.2
0:3.4.1-2.el10_0.2
rsync
Red Hat:rhel_e4s:8.8::baseos
 before 0:3.1.3-20.el8_8.5
0:3.1.3-20.el8_8.5
rsync
Red Hat:rhel_tus:8.8::baseos
 before 0:3.1.3-20.el8_8.5
0:3.1.3-20.el8_8.5
rsync
Red Hat:rhel_aus:8.4::baseos
 before 0:3.1.3-12.el8_4.7
0:3.1.3-12.el8_4.7
rsync-daemon
Red Hat:rhel_aus:8.4::baseos
 before 0:3.1.3-12.el8_4.7
0:3.1.3-12.el8_4.7
rsync
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:3.1.3-12.el8_4.7
0:3.1.3-12.el8_4.7
rsync-daemon
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:3.1.3-12.el8_4.7
0:3.1.3-12.el8_4.7
rsync
Red Hat:rhel_els:7
 before 0:3.1.2-12.el7_9.3
0:3.1.2-12.el7_9.3
rsync
Red Hat:rhel_els:6
 before 0:3.0.6-12.el6_10.3
0:3.0.6-12.el6_10.3
rsync
Red Hat:rhel_aus:8.6::baseos
 before 0:3.1.3-14.el8_6.10
0:3.1.3-14.el8_6.10
rsync
Red Hat:rhel_eus_long_life:8.6::baseos
 before 0:3.1.3-14.el8_6.10
0:3.1.3-14.el8_6.10
rsync
Rocky Linux:8
 before 0:3.1.3-25.el8_10
0:3.1.3-25.el8_10
rsync
Rocky Linux:10
 before 0:3.4.1-6.el10_2
0:3.4.1-6.el10_2
rsync
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.2.5-7.el9_8
0:3.2.5-7.el9_8
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.4.1-160000.4.1
3.4.1-160000.4.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.4.1-160000.4.1
3.4.1-160000.4.1
rsync
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 3.2.3-150400.3.34.1
3.2.3-150400.3.34.1
rsync
Ubuntu:Pro:14.04:LTS
 before 3.1.0-2ubuntu0.4+esm3, plus listed versions
3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.33.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm2
3.1.0-2ubuntu0.4+esm3
rsync
Ubuntu:Pro:16.04:LTS
 before 3.1.1-3ubuntu1.3+esm5, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3
Show 4 moreShow less
3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm4
3.1.1-3ubuntu1.3+esm5
rsync
Ubuntu:Pro:18.04:LTS
 before 3.1.2-2.1ubuntu1.6+esm3, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2
Show 6 moreShow less
3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm2
3.1.2-2.1ubuntu1.6+esm3
rsync
Ubuntu:Pro:20.04:LTS
 before 3.1.3-8ubuntu0.9+esm1, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
Show 5 moreShow less
3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.9
3.1.3-8ubuntu0.9+esm1
rsync
Ubuntu:22.04:LTS
 before 3.2.7-0ubuntu0.22.04.6, plus listed versions
3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3
Show 4 moreShow less
3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.4
3.2.7-0ubuntu0.22.04.6
rsync
Ubuntu:24.04:LTS
 before 3.2.7-1ubuntu1.4, plus listed versions
3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.2
3.2.7-1ubuntu1.4
rsync
Ubuntu:25.10
 before 3.4.1+ds1-5ubuntu1.2, plus listed versions
3.4.1+ds1-33.4.1+ds1-43.4.1+ds1-53.4.1+ds1-5ubuntu1
3.4.1+ds1-5ubuntu1.2
rsync
Ubuntu:26.04:LTS
 before 3.4.1+ds1-7ubuntu0.2, plus listed versions
3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-7
3.4.1+ds1-7ubuntu0.2
rsync
openSUSE:Tumbleweed
 before 3.4.1-5.1
3.4.1-5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41035 is a high vulnerability (CVSS 7.4) in Samba Rsync, published April 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in rsync 3.4.1-r2.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 9 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 8 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open