{"id":"CVE-2026-41035","aliases":["ALPINE-CVE-2026-41035","ALSA-2026:17481","ALSA-2026:19152","ALSA-2026:19368","AZL-82958","BELL-CVE-2026-41035","CLSA-2026-1778940132","CLSA-2026-1779131668","CLSA-2026-1779154430","CLSA-2026-1780054763","CLSA-2026-1780054955","CLSA-2026-1780055137","CLSA-2026-1780062116","CLSA-2026-1780062671","CLSA-2026-1780064425","CLSA-2026-1780066764","CLSA-2026-1780388397","CLSA-2026-1780388593","CLSA-2026-1780389337","CLSA-2026-1782739272","DEBIAN-CVE-2026-41035","EUVD-2026-23215","GHSA-m34r-4v3r-pp9v","JLSEC-2026-627","MGASA-2026-0101","OESA-2026-2150","RHSA-2026:17481","RHSA-2026:19152","RHSA-2026:19368","RHSA-2026:20601","RHSA-2026:20602","RHSA-2026:20603","RHSA-2026:20604","RHSA-2026:20696","RHSA-2026:25149","RHSA-2026:25170","RHSA-2026:25172","RHSA-2026:25173","RHSA-2026:25190","RLSA-2026:17481","RLSA-2026:19152","RLSA-2026:19368","SUSE-SU-2026:2002-1","SUSE-SU-2026:2038-1","SUSE-SU-2026:2048-1","SUSE-SU-2026:2083-1","SUSE-SU-2026:21676-1","SUSE-SU-2026:21686-1","SUSE-SU-2026:21726-1","SUSE-SU-2026:21739-1","SUSE-SU-2026:21747-1","SUSE-SU-2026:21795-1","SUSE-SU-2026:21980-1","SUSE-SU-2026:22015-1","SUSE-SU-2026:3634-1","UBUNTU-CVE-2026-41035","openSUSE-SU-2026:10775-1","openSUSE-SU-2026:20754-1","openSUSE-SU-2026:20877-1"],"status":"published","title":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00393,"percentile":0.33901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-130","CWE-805"],"published":"2026-04-16T06:53:05Z","modified":"2026-10-29T11:32:33Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rsync","fixed_in":["3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rsync-daemon","fixed_in":["3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rsync","fixed_in":["3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rsync-daemon","fixed_in":["3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rsync-rrsync","fixed_in":["3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.2.7-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","fixed_in":["3.1.3-19.el8.1.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","fixed_in":["3.1.3-19.el8.1.tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync","fixed_in":["3.1.3-12.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","fixed_in":["3.1.3-12.el8.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"rsync","fixed_in":["3.0.6-12.el6.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"rsync","fixed_in":["3.0.6-12.el6.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"rsync","fixed_in":["3.1.3-6+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","fixed_in":["3.2.3-19.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","fixed_in":["3.2.3-19.el9_2.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","fixed_in":["3.2.5-3.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"rsync","fixed_in":["3.1.2-12.0.1.el7_9.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.7-1+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.4.1+ds1-5+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.4.2+ds1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"rsync_jll","fixed_in":["3.4.4+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"rsync","fixed_in":["3.2.7-1.4.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","fixed_in":["3.1.3-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","fixed_in":["3.2.5-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"rsync","fixed_in":["3.2.7-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","fixed_in":["3.2.7-8.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"rsync","fixed_in":["3.2.7-8.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","fixed_in":["0:3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","fixed_in":["0:3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","fixed_in":["0:3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-daemon","fixed_in":["0:3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-rrsync","fixed_in":["0:3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync","fixed_in":["0:3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debuginfo","fixed_in":["0:3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debugsource","fixed_in":["0:3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"rsync-daemon","fixed_in":["0:3.2.3-9.el9_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"rsync","fixed_in":["0:3.2.3-9.el9_0.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"rsync","fixed_in":["0:3.1.3-20.el8_8.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"rsync","fixed_in":["0:3.1.3-20.el8_8.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"rsync","fixed_in":["0:3.1.3-12.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-12.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"rsync","fixed_in":["0:3.1.3-12.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-12.el8_4.7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"rsync","fixed_in":["0:3.1.2-12.el7_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:6","package":"rsync","fixed_in":["0:3.0.6-12.el6_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"rsync","fixed_in":["0:3.1.3-14.el8_6.10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"rsync","fixed_in":["0:3.1.3-14.el8_6.10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rsync","fixed_in":["0:3.1.3-25.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"rsync","fixed_in":["0:3.4.1-6.el10_2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","fixed_in":["3.1.0-2ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rsync","fixed_in":["3.2.7-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rsync","fixed_in":["3.4.1+ds1-5ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rsync","fixed_in":["3.4.1+ds1-7ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rsync","fixed_in":["3.4.1-5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.2.7-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-r0"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-19.el8.1.tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.el8.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-12.el6.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-6+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+tuxcare.els4"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u5"}]}],"versions":["3.2.7-1","3.2.7-1+deb12u1","3.2.7-1+deb12u2","3.2.7-1+deb12u3","3.2.7-1+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5+deb13u2"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-5+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2+ds1-1"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1"]},{"source":"osv","ecosystem":"Julia","package":"rsync_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.4.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-8.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-8.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-9.el9_0.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-20.el8_8.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-20.el8_8.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-12.el8_4.7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-12.el7_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.6-12.el6_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-14.el8_6.10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-25.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-6.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-7.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.34.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm3"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm5"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm3"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+esm1"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.6"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.4"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5ubuntu1.2"}]}],"versions":["3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-5","3.4.1+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7ubuntu0.2"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6","3.4.1+ds1-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-5.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6 extended lifecycle support  - extension"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/04/16/2","tags":["Exploit","Mailing List","Third Party Advisory","web","article","report"]},{"url":"https://github.com/RsyncProject/rsync/releases","tags":["Release Notes","package","web","article"]},{"url":"https://github.com/RsyncProject/rsync/issues/871","tags":["Issue Tracking","report","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/16/9","tags":["Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/22/3","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41035","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458898","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41035.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25173","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25172","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59831","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26542","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28887","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23233","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25044","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34098","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25181","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23245","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20696","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19152","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20601","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20602","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20604","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20603","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19368","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17481","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25170","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25190","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25149","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41035","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m34r-4v3r-pp9v","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-41035","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2458898","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-17481.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-19152.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12086","tags":["report"]},{"url":"https://bugzilla.redhat.com/2330577","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-19368.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-41035","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1778940132.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1779131668.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1779154430.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1780054763.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1780054955.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1780055137.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1780062116.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1780062671.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780064425.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780066764.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1780388397.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12087","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1780388593.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780389337.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1782739272.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29518","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41035.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41035","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0101.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35373","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/16/9","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2150","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17481.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41035","tags":["advisory","report"]},{"url":"https://issues.redhat.com/browse/RHEL-172276","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19152.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330577","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19368.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12086","tags":["advisory"]},{"url":"https://kb.cert.org/vuls/id/952657","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20601.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2415637","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20602.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10158","tags":["advisory"]},{"url":"https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1","tags":["article"]},{"url":"https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20603.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20604.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-174895","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20696.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25149.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25170.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25172.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25173.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25190.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:17481","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19152","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:19368","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262002-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621676-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621686-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621747-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621795-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621980-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622015-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263634-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269039","tags":["report"]},{"url":"https://bugzilla.suse.com/1269040","tags":["report"]},{"url":"https://bugzilla.suse.com/1269041","tags":["report"]},{"url":"https://bugzilla.suse.com/1269042","tags":["report"]},{"url":"https://bugzilla.suse.com/1269043","tags":["report"]},{"url":"https://bugzilla.suse.com/1269044","tags":["report"]},{"url":"https://bugzilla.suse.com/1269045","tags":["report"]},{"url":"https://bugzilla.suse.com/1269046","tags":["report"]},{"url":"https://bugzilla.suse.com/1269047","tags":["report"]},{"url":"https://bugzilla.suse.com/1269048","tags":["report"]},{"url":"https://bugzilla.suse.com/1269049","tags":["report"]},{"url":"https://bugzilla.suse.com/1269050","tags":["report"]},{"url":"https://bugzilla.suse.com/1269051","tags":["report"]},{"url":"https://bugzilla.suse.com/1269052","tags":["report"]},{"url":"https://bugzilla.suse.com/1269053","tags":["report"]},{"url":"https://bugzilla.suse.com/1269054","tags":["report"]},{"url":"https://bugzilla.suse.com/1269055","tags":["report"]},{"url":"https://bugzilla.suse.com/1269056","tags":["report"]},{"url":"https://bugzilla.suse.com/1269057","tags":["report"]},{"url":"https://bugzilla.suse.com/1269058","tags":["report"]},{"url":"https://bugzilla.suse.com/1269060","tags":["report"]},{"url":"https://bugzilla.suse.com/1273429","tags":["report"]},{"url":"https://bugzilla.suse.com/1273430","tags":["report"]},{"url":"https://bugzilla.suse.com/1273431","tags":["report"]},{"url":"https://bugzilla.suse.com/1273432","tags":["report"]},{"url":"https://bugzilla.suse.com/1273433","tags":["report"]},{"url":"https://bugzilla.suse.com/1273434","tags":["report"]},{"url":"https://bugzilla.suse.com/1273435","tags":["report"]},{"url":"https://bugzilla.suse.com/1273436","tags":["report"]},{"url":"https://bugzilla.suse.com/1273437","tags":["report"]},{"url":"https://bugzilla.suse.com/1273438","tags":["report"]},{"url":"https://bugzilla.suse.com/1273439","tags":["report"]},{"url":"https://bugzilla.suse.com/1273440","tags":["report"]},{"url":"https://bugzilla.suse.com/1273441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70464","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-41035","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8283-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41035","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T06:53:05.237Z","modified":"2026-09-04T12:04:47.004Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-130","CWE-805"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-23215","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T06:53:05Z","modified":"2026-09-04T12:04:47Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:01:12.73639Z"}],"ghsa":[{"id":"GHSA-m34r-4v3r-pp9v","title":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T09:31:44Z","modified":"2026-09-04T15:35:01Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-130","CWE-805"],"updated_at":"2026-11-02T15:11:21.957806Z"}],"nvd":[{"id":"CVE-2026-41035","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T07:16:31.003Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-130","CWE-805"],"updated_at":"2026-11-02T14:12:14.748836Z"}],"osv":[{"id":"ALPINE-CVE-2026-41035","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T07:16:31.003Z","modified":"2026-10-01T02:17:49.28100241Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-41035","status":"published","published":"2026-04-18T06:09:09.580652Z","modified":"2026-05-23T07:15:10.815139203Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-41035","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T06:53:05.237Z","modified":"2026-10-28T02:30:47.481406146Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-41035","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T07:16:31.003Z","modified":"2026-10-27T09:47:38.69638369Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"JLSEC-2026-627","title":"In rsync 3.0.1 through 3.4.1, `receive_xattr` relies on an untrusted length value during a qsort...","description":"In rsync 3.0.1 through 3.4.1, `receive_xattr` relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-06-25T17:41:14.392Z","modified":"2026-07-25T18:23:58.032890284Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2150","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.(CVE-2026-41035)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.712659012Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:17481","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-15T10:15:00Z","modified":"2026-10-10T10:05:07Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19152","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-20T10:10:05Z","modified":"2026-10-10T10:05:30Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:19368","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-20T10:10:39Z","modified":"2026-10-10T10:05:39Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20601","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:45Z","modified":"2026-10-10T10:05:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20602","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:46Z","modified":"2026-10-10T10:05:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20603","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:46Z","modified":"2026-10-10T10:05:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20604","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:47Z","modified":"2026-10-10T10:05:57Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20696","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-27T10:07:23Z","modified":"2026-10-10T10:06:02Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:25149","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-11T10:09:20Z","modified":"2026-10-10T10:06:29Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25170","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-11T10:09:21Z","modified":"2026-10-10T10:06:30Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25172","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-11T10:09:22Z","modified":"2026-10-10T10:06:30Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25173","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-11T10:09:22Z","modified":"2026-10-10T10:06:31Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25190","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-06-11T10:09:23Z","modified":"2026-10-10T10:06:31Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RLSA-2026:17481","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-15T18:00:45.065378Z","modified":"2026-05-15T18:25:08.231364Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:19152","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T16:03:24.060458Z","modified":"2026-05-29T16:30:35.947690941Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:19368","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: rsync server leaks arbitrary client files (CVE-2024-12086)\n\n* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:30.461218888Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-41035","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T07:16:00Z","modified":"2026-06-30T18:18:03.28932236Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:17481","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-14T00:00:00Z","modified":"2026-10-29T11:02:23.687347919Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19152","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:30:24.145295257Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:19368","title":"Important: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: rsync server leaks arbitrary client files (CVE-2024-12086)\n  * rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-19T00:00:00Z","modified":"2026-10-29T11:32:33.9941527Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"AZL-82958","title":"CVE-2026-41035 affecting package rsync for versions less than 3.4.3-1","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.","status":"published","published":"2026-04-16T07:16:31Z","modified":"2026-08-28T17:56:43.256485Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"CLSA-2026-1778940132","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: receiver use-after-free in receive_xattr via untrusted\n  xattr count passed to qsort","status":"published","published":"2026-05-16T15:14:15Z","modified":"2026-06-01T00:33:14.73523934Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779131668","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: receiver use-after-free in receive_xattr via untrusted\n  xattr count passed to qsort","status":"published","published":"2026-05-19T00:11:05Z","modified":"2026-06-01T00:33:23.894323666Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779154430","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: receiver use-after-free in receive_xattr via untrusted\n  xattr count passed to qsort","status":"published","published":"2026-05-19T01:33:54Z","modified":"2026-06-01T00:33:13.174703236Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780054763","title":"Fix CVE(s): CVE-2026-41035","description":"   * SECURITY UPDATE: use-after-free in receive_xattr()\n     - debian/patches/CVE-2026-41035.patch: replace stale local 'count'\n       with temp_xattr.count in the qsort call inside receive_xattr(),\n       so the sort uses the live size of the rebuilt xattr items list;\n       victim must run rsync with -X / --xattrs\n     - CVE-2026-41035","status":"published","published":"2026-05-29T11:39:28Z","modified":"2026-06-04T10:03:22.170991Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780054955","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: fix use-after-free in receive_xattr by using temp_xattr.count instead of the stale count in qsort","status":"published","published":"2026-05-29T11:42:40Z","modified":"2026-10-26T09:31:45.32984095Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780055137","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: fix use-after-free in receive_xattr by using temp_xattr.count instead of the stale count in qsort","status":"published","published":"2026-05-30T10:23:26Z","modified":"2026-10-26T09:31:39.056341097Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780062116","title":"Fix CVE(s): CVE-2026-41035","description":"   * SECURITY UPDATE: use-after-free in receive_xattr()\n     - debian/patches/CVE-2026-41035.patch: replace stale local 'count'\n       with temp_xattr.count in the qsort call inside receive_xattr(),\n       so the sort uses the live size of the rebuilt xattr items list;\n       victim must run rsync with -X / --xattrs\n     - CVE-2026-41035","status":"published","published":"2026-05-29T13:42:01Z","modified":"2026-06-04T10:03:58.178095Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780062671","title":"Fix CVE(s): CVE-2026-41035","description":"   * SECURITY UPDATE: receiver use-after-free in receive_xattr() via a\n     wire-supplied xattr count passed to qsort():\n     - debian/patches/els/0007-CVE-2026-41035.patch: sort temp_xattr.count\n       stored items instead of the untrusted wire count.\n     - CVE-2026-41035.","status":"published","published":"2026-05-29T14:28:14Z","modified":"2026-06-04T10:04:08.83629Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780064425","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: fix use of wrong element count in qsort call in\n  receive_xattr() leading to SIGSEGV","status":"published","published":"2026-05-29T14:20:29Z","modified":"2026-10-26T09:30:02.908068176Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780066764","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: fix use-after-free in receive_xattr() caused by qsort()\n  being called with a stale local 'count' variable instead of the live\n  temp_xattr.count after the rxa list was rebuilt; victim runs rsync with\n  -X / --xattrs (lifted verbatim from upstream rsync 968d4c0c)","status":"published","published":"2026-05-29T14:59:29Z","modified":"2026-10-26T09:31:06.747583899Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780388397","title":"rsync: Fix of 3 CVEs","description":"- CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count","status":"published","published":"2026-06-25T09:03:50Z","modified":"2026-10-26T09:31:57.966118945Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780388593","title":"rsync: Fix of 2 CVEs","description":"- CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count","status":"published","published":"2026-06-24T14:04:10Z","modified":"2026-10-26T09:31:54.454585382Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780389337","title":"rsync: Fix of CVE-2026-41035","description":"- CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count","status":"published","published":"2026-06-04T12:10:11Z","modified":"2026-10-26T09:31:41.664038949Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782739272","title":"Fix CVE(s): CVE-2026-29518, CVE-2026-41035","description":"   * PACKAGING FIX: rsync daemon default group on stock Ubuntu/Debian (ELSR-8050)\n     - the daemon's compile-time NOBODY_GROUP was resolved to \"nobody\" by the\n       focal build chroot's /etc/group, but stock Ubuntu/Debian have only\n       \"nogroup\", so daemon modules with no explicit gid were rejected with\n       \"@ERROR: invalid gid nobody\" (test_daemon / ELSR-8050)\n     - debian/rules: build with rsync's own --with-nobody-group=nogroup\n       configure option so the compile-time NOBODY_GROUP default is baked as\n       \"nogroup\" regardless of the build chroot, matching the stock\n       Ubuntu/Debian rsync build (fixes modules with no explicit gid)\n     - debian/patches/rsync-daemon-nobody-group-fallback.patch: in the daemon's\n       add_a_group() resolve a \"nobody\" group to \"nogroup\" at runtime when the\n       host has no \"nobody\" group, so a module that explicitly sets\n       \"gid = nobody\" is also honoured on stock Ubuntu/Debian instead of being\n       rejected with \"@ERROR: invalid gid nobody\"; any other unresolvable group\n       is still rejected\n     - upstream: configure.ac AC_ARG_WITH(nobody-group)\n       https://github.com/RsyncProject/rsync/blob/v3.1.3/configure.ac#L142-L157\n       Debian bugs #144570 (https://bugs.debian.org/144570) and #25299\n     - ELSR-8050","status":"published","published":"2026-06-29T13:21:30Z","modified":"2026-10-26T09:32:05.332808732Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"MGASA-2026-0101","title":"Updated rsync packages fix security vulnerability","description":"In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted\nlength value during a qsort call, leading to a receiver use-after-free.\nThe victim must run rsync with -X (aka --xattrs). On Linux, many (but\nnot all) common configurations are vulnerable. Non-Linux platforms are\nmore widely vulnerable. (CVE-2026-41035)\n","status":"published","published":"2026-04-18T02:40:55Z","modified":"2026-04-18T02:45:29.673659Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10775-1","title":"rsync-3.4.1-5.1 on GA media","description":"These are all security issues fixed in the rsync-3.4.1-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-13T00:00:00Z","modified":"2026-05-14T08:17:07.730559Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20754-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n","status":"published","published":"2026-05-14T16:43:27Z","modified":"2026-05-19T18:23:46.729114849Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20877-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:13:41Z","modified":"2026-06-04T09:00:10.423530016Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2002-1","title":"Security update for rsync","description":"This update for rsync fixes the following issue\n\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n","status":"published","published":"2026-05-19T08:21:38Z","modified":"2026-05-20T08:00:07.170172532Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2038-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n    \n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T13:33:41Z","modified":"2026-05-22T09:00:05.164069318Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2048-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-25T13:55:42Z","modified":"2026-05-26T08:15:05.350251039Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2083-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-27T07:56:11Z","modified":"2026-05-28T08:15:05.799079873Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21676-1","title":"Security update for rsync","description":"This update for rsync fixes the following issue\n\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n","status":"published","published":"2026-05-15T10:45:40Z","modified":"2026-05-20T18:23:54.41256562Z","updated_at":"2026-11-02T15:54:02.654057Z"}]},"sources_more":{"osv":8}}