Skip to content
Fencer Intel
high 7.4

CVE-2026-41035 json

In rsync 3.0.1 through 3.4.1, `receive_xattr` relies on an untrusted length value during a qsort...

published 6mo ago modified 14d ago also EUVD-2026-23215 , GHSA-m34r-4v3r-pp9v , JLSEC-2026-627

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Patch / fix

  • julia rsync_jll 3.4.4+0
  • Red Hat Red Hat Enterprise Linux 10 0:3.4.1-6.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:3.4.1-2.el10_0.2
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:3.0.6-12.el6_10.3
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:3.1.2-12.el7_9.3
  • Red Hat Red Hat Enterprise Linux 8 0:3.1.3-25.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:3.1.3-12.el8_4.7
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:3.1.3-12.el8_4.7
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:3.1.3-14.el8_6.10
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:3.1.3-14.el8_6.10
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:3.1.3-20.el8_8.5
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:3.1.3-20.el8_8.5
  • Red Hat Red Hat Enterprise Linux 9 0:3.2.5-7.el9_8
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:3.2.3-9.el9_0.5
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.2.3-19.el9_2.3
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:3.2.3-19.el9_4.3
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.2.5-3.el9_6.1
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202606160406-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202606231112-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202606030318-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202606051757-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202606250942-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202606051320-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202606031700-0
  • Red Hat Red Hat Discovery 2 1782166952
  • rsync Debian 12 3.2.7-1+deb12u5
  • rsync Debian 13 3.4.1+ds1-5+deb13u2
  • rsync Debian 14 3.4.2+ds1-1

debian advisories DEBIAN-CVE-2026-41035

  • rsync Ubuntu 22.04 LTS 3.2.7-0ubuntu0.22.04.6
  • rsync Ubuntu 24.04 LTS 3.2.7-1ubuntu1.4
  • rsync Ubuntu 25.10 3.4.1+ds1-5ubuntu1.2
  • rsync Ubuntu 26.04 LTS 3.4.1+ds1-7ubuntu0.2
  • rsync Ubuntu Pro 14.04 LTS 3.1.0-2ubuntu0.4+esm3
  • rsync Ubuntu Pro 16.04 LTS 3.1.1-3ubuntu1.3+esm5
  • rsync Ubuntu Pro 18.04 LTS 3.1.2-2.1ubuntu1.6+esm3
  • rsync Ubuntu Pro 20.04 LTS 3.1.3-8ubuntu0.9+esm1

ubuntu advisories UBUNTU-CVE-2026-41035

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsync RHEL 9 3.2.5-7.el9_8
  • rsync-daemon RHEL 9 3.2.5-7.el9_8
  • rsync-rrsync RHEL 9 3.2.5-7.el9_8
  • rsync RHEL 10.2 3.4.1-6.el10_2
  • rsync-daemon RHEL 10.2 3.4.1-6.el10_2
  • rsync-rrsync RHEL 10.2 3.4.1-6.el10_2
  • rsync RHEL 8 3.1.3-25.el8_10
  • rsync-daemon RHEL 8 3.1.3-25.el8_10

red hat advisories RHSA-2026:25190RHSA-2026:25172RHSA-2026:25173RHSA-2026:25170RHSA-2026:25149RHSA-2026:20696

  • rsync SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 3.2.3-150400.3.34.1
  • rsync SLES for SAP applications 16.0, SLES 16.0 3.4.1-160000.4.1

suse advisories SUSE-SU-2026:3634-1SUSE-SU-2026:22015-1

  • rsync openSUSE Tumbleweed 3.4.1-5.1

opensuse advisories openSUSE-SU-2026:10775-1

  • rsync AlmaLinux 10 3.4.1-6.el10_2
  • rsync-daemon AlmaLinux 10 3.4.1-6.el10_2
  • rsync-rrsync AlmaLinux 10 3.4.1-6.el10_2
  • rsync AlmaLinux 9 3.2.5-7.el9_8
  • rsync-daemon AlmaLinux 9 3.2.5-7.el9_8
  • rsync-rrsync AlmaLinux 9 3.2.5-7.el9_8
  • rsync AlmaLinux 8 3.1.3-25.el8_10
  • rsync-daemon AlmaLinux 8 3.1.3-25.el8_10

almalinux advisories ALSA-2026:19152ALSA-2026:19368ALSA-2026:17481

  • rsync Rocky Linux 10 3.4.1-6.el10_2
  • rsync Rocky Linux 9 3.2.5-7.el9_8
  • rsync Rocky Linux 8 3.1.3-25.el8_10

rocky linux advisories RLSA-2026:19152RLSA-2026:19368RLSA-2026:17481

  • rsync Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 3.4.1-r2

alpine advisories ALPINE-CVE-2026-41035

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsync Azure Linux 3.0 3.4.3-1

azure linux advisories AZL-82958

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-41035 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41035 updated cvss 7.4

rsync: Rsync: Use-after-free vulnerability in extended attribute handling

  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1782166952
    fixed: vendor fix RHSA-2026:29197
  • Red Hat Enterprise Linux AppStream (v. 9) rsync-daemon 3.2.5-7.el9_8, rsync-rrsync 3.2.5-7.el9_8
    fixed: vendor fix RHSA-2026:19368
  • Red Hat Enterprise Linux AppStream (v. 10) rsync-daemon 3.4.1-6.el10_2, rsync-rrsync 3.4.1-6.el10_2
    fixed: vendor fix RHSA-2026:19152
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) rsync-daemon 3.2.3-9.el9_0.5
    fixed: vendor fix RHSA-2026:20601
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) rsync-daemon 3.2.3-19.el9_2.3
    fixed: vendor fix RHSA-2026:20602
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rsync-daemon 3.4.1-2.el10_0.2
    fixed: vendor fix RHSA-2026:20696
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rsync-daemon 3.2.3-19.el9_4.3
    fixed: vendor fix RHSA-2026:20604
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rsync-daemon 3.2.5-3.el9_6.1
    fixed: vendor fix RHSA-2026:20603
show 25 more
  • Red Hat Enterprise Linux BaseOS (v. 8) rsync 3.1.3-25.el8_10, rsync-daemon 3.1.3-25.el8_10
    fixed: vendor fix RHSA-2026:17481
  • Red Hat Enterprise Linux BaseOS (v. 9) rsync 3.2.5-7.el9_8
    fixed: vendor fix RHSA-2026:19368
  • Red Hat Enterprise Linux BaseOS (v. 10) rsync 3.4.1-6.el10_2
    fixed: vendor fix RHSA-2026:19152
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) rsync 3.1.3-12.el8_4.7, rsync-daemon 3.1.3-12.el8_4.7
    fixed: vendor fix RHSA-2026:25170
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) rsync 3.1.3-14.el8_6.10
    fixed: vendor fix RHSA-2026:25190
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) rsync 3.1.3-20.el8_8.5
    fixed: vendor fix RHSA-2026:25149
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) rsync 3.2.3-9.el9_0.5
    fixed: vendor fix RHSA-2026:20601
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) rsync 3.2.3-19.el9_2.3
    fixed: vendor fix RHSA-2026:20602
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) rsync 3.4.1-2.el10_0.2
    fixed: vendor fix RHSA-2026:20696
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) rsync 3.2.3-19.el9_4.3
    fixed: vendor fix RHSA-2026:20604
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) rsync 3.2.5-3.el9_6.1
    fixed: vendor fix RHSA-2026:20603
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) rsync 3.1.3-12.el8_4.7, rsync-daemon 3.1.3-12.el8_4.7
    fixed: vendor fix RHSA-2026:25170
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) rsync 3.1.3-14.el8_6.10
    fixed: vendor fix RHSA-2026:25190
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) rsync 3.1.3-20.el8_8.5
    fixed: vendor fix RHSA-2026:25149
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) rsync 3.0.6-12.el6_10.3
    fixed: vendor fix RHSA-2026:25173
  • Red Hat Enterprise Linux Server (v. 7 ELS) rsync 3.1.2-12.el7_9.3
    fixed: vendor fix RHSA-2026:25172
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157
    fixed: vendor fix RHSA-2026:59831
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202606160406
    fixed: vendor fix RHSA-2026:26542
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202606231112
    fixed: vendor fix RHSA-2026:28887
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202606030318
    fixed: vendor fix RHSA-2026:23233
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202606051757
    fixed: vendor fix RHSA-2026:25044
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202606250942
    fixed: vendor fix RHSA-2026:34098
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202606051320
    fixed: vendor fix RHSA-2026:25181
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202606031700
    fixed: vendor fix RHSA-2026:23245
  • Red Hat Discovery 2 discovery/discovery-server-rhel9 1782159791 Red Hat Enterprise Linux AppStream EUS (v. 10.0) rsync-rrsync 3.4.1-2.el10_0.2 Red Hat Enterprise Linux AppStream EUS (v.9.6) rsync-rrsync 3.2.5-3.el9_6.1 Red Hat Enterprise Linux BaseOS AUS (v.8.4) rsync-debuginfo 3.1.3-12.el8_4.7, rsync-debugsource 3.1.3-12.el8_4.7 Red Hat Enterprise Linux BaseOS AUS (v.8.6) rsync-daemon 3.1.3-14.el8_6.10 Red Hat Enterprise Linux BaseOS E4S (v.8.8) rsync-daemon 3.1.3-20.el8_8.5
    +2 more products
    Red Hat Enterprise Linux BaseOS E4S (v.9.0) rsync-debuginfo 3.2.3-9.el9_0.5, rsync-debugsource 3.2.3-9.el9_0.5 Red Hat Enterprise Linux BaseOS E4S (v.9.2) rsync-debuginfo 3.2.3-19.el9_2.3, rsync-debugsource 3.2.3-19.el9_2.3
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • openwall.com https://www.openwall.com/lists/oss-security/2026/04/16/2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia rsync_jll
<3.4.4+0
3.4.4+0

Affected products

  • Samba rsync
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency
  • CWE-805 Buffer Access with Incorrect Length Value

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.