High severity7.4NVD Advisory· Published Apr 16, 2026· Updated May 21, 2026
CVE-2026-41035
CVE-2026-41035
Description
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- osv-coords6 versionspkg:rpm/almalinux/rsyncpkg:rpm/almalinux/rsync-daemonpkg:rpm/almalinux/rsync-rrsyncpkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweedpkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/rsync&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 3.1.3-25.el8_10+ 5 more
- (no CPE)range: < 3.1.3-25.el8_10
- (no CPE)range: < 3.1.3-25.el8_10
- (no CPE)range: < 3.4.1-6.el10_2
- (no CPE)range: < 3.4.1-5.1
- (no CPE)range: < 3.4.1-160000.4.1
- (no CPE)range: < 3.4.1-160000.4.1
Patches
Vulnerability mechanics
References
5- www.openwall.com/lists/oss-security/2026/04/16/2nvdExploitMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/04/16/9nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2026/04/22/3nvdMailing ListThird Party Advisory
- github.com/RsyncProject/rsync/issues/871nvdIssue Tracking
- github.com/RsyncProject/rsync/releasesnvdRelease Notes
News mentions
0No linked articles in our index yet.