AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon (ALMALINUX9.2:CLSA-2026:1780064425)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780064425 advisory. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T...

CentOS Linux 8.5 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.5:CLSA-2026:1779131668)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1779131668 advisory. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1776791634)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1776791634 advisory. - The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr...

CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.4:CLSA-2026:1779154430)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1779154430 advisory. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync (ALMALINUX9.6:CLSA-2026:1780066764)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780066764 advisory. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync (ALMALINUX9.6:CLSA-2026:1780066764)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780066764 advisory. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS-STREAM8:CLSA-2026:1778940132)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778940132 advisory. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-fre...

Astra Linux – Vulnerability in rsync

In rsync versions 3.0.1 through 3.4.1, the receivexattr function relies on an untrusted length value during a qsort call, resulting in a use-after-free vulnerability. The vulnerability is exploitable when rsync is executed with the -X option also known as --xattrs. On Linux, many but not all comm...

EulerOS 2.0 SP10 : rsync (EulerOS-SA-2026-2710)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victi...

EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-2626)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checke...

rsync: Rsync: Use-after-free vulnerability in extended attribute handling

A flaw was found in rsync. When rsync is configured to handle extended attributes using the -X or --xattrs option, a remote attacker can exploit a use-after-free vulnerability. This occurs because the receivexattr function incorrectly processes an untrusted length value during a sorting operation...

rsync: Rsync: Use-after-free vulnerability in extended attribute handling

A flaw was found in rsync. When rsync is configured to handle extended attributes using the -X or --xattrs option, a remote attacker can exploit a use-after-free vulnerability. This occurs because the receivexattr function incorrectly processes an untrusted length value during a sorting operation...

TencentOS Server 3: rsync (TSSA-2026:0379)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0379 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CLSA-2026-1779154430 rsync: Fix of CVE-2026-41035

CVE-2026-41035: receiver use-after-free in receivexattr via untrusted xattr count passed to qsort...

Updated rsync packages fix security vulnerability

In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X aka --xattrs. On Linux, many but not all common configurations are vulnerable. Non-Linux platforms are more widely vulnerable...

AZL-82958 CVE-2026-41035 affecting package rsync for versions less than 3.4.3-1

In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X aka --xattrs. On Linux, many but not all common configurations are vulnerable. Non-Linux platforms are more widely vulnerable...

Linux Distros Unpatched Vulnerability : CVE-2026-41035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run...

CVE-2026-41035: Improper Handling of Length Parameter Inconsistency

In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X aka --xattrs. On Linux, many but not all common configurations are vulnerable. Non-Linux platforms are more widely vulnerable...

SUSE CVE-2017-16548

The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified other impact by sendi...

rsync -- multiple vulnerabilities

Jeriko One reports: The receivexattr function in xattrs.c in rsync 3.1.2 and 3.1.3-development does not check for a trailing '\0' character in an xattr name, which allows remote attackers to cause a denial of service heap-based buffer over-read and application crash or possibly have unspecified...