Security · rsync rsync

rsync Use-After-Free Flaw (CVE-2026-41035) Affects Versions 3.0.1 Through 3.4.1 When Extended Attributes Are Enabled

·

CVE-2026-41035 describes a receiver-side use-after-free in rsync 3.0.1 through 3.4.1, where receive_xattr passes an untrusted length value to a qsort call. Exploitation requires the victim to run rsync with -X (--xattrs); many common Linux configurations are vulnerable, and non-Linux platforms are more widely affected.

Related coverage