--- id: CVE-2026-41035 title: >- In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free summary: >- In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configuratio… severity: high cvss: 7.4 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L' cwe: - CWE-130 - CWE-805 vendor: samba product: rsync affected: - 'rsync >= 3.0.1, <= 3.4.1' published: '2026-04-16' updated: '2026-07-02' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41035' references: - url: 'https://github.com/RsyncProject/rsync/issues/871' label: cve@mitre.org - url: 'https://github.com/RsyncProject/rsync/releases' label: cve@mitre.org - url: 'https://www.openwall.com/lists/oss-security/2026/04/16/2' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2026/04/16/9' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2026/04/22/3' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:17481' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19152' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19368' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20601' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20602' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20603' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20604' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20696' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23233' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23245' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25044' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25149' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25170' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25172' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25173' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25181' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:25190' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26542' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:28887' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:29197' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-41035' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2458898' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41035.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-41035' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41035' - url: 'https://access.redhat.com/errata/RHSA-2026:59831' - url: 'https://access.redhat.com/errata/RHSA-2026:34098' tags: - nvd - csaf - vex - red-hat epss: 0.00393 epssPercentile: 0.33241 ingestedAt: '2026-07-02T12:34:40.529Z' patched: - enterprise_linux_server_extension_v_6_els_extension - enterprise_linux_server_v_7_els - openshift_container_platform 4.12 - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.15 - openshift_container_platform 4.16 - openshift_container_platform 4.17 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_e4s_v_9_0 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_eus_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_eus_extension_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_0 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_eus_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - discovery 2 --- ## Overview In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable. ## Affected - `rsync >= 3.0.1, <= 3.4.1` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:25173** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:25173) - **RHSA-2026:25172** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:25172) - **RHSA-2026:59831** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:59831) - **RHSA-2026:26542** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:26542) - **RHSA-2026:28887** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-07-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:28887) - **RHSA-2026:23233** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-06-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:23233) - **RHSA-2026:25044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-06-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:25044) - **RHSA-2026:34098** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:34098) - **RHSA-2026:25181** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:25181) - **RHSA-2026:23245** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:23245) - **RHSA-2026:20696** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20696)