https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:02:46 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:17481 <p><strong>Affected:</strong> AlmaLinux:8: rsync, AlmaLinux:8: rsync-daemon</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: rsync, AlmaLinux:8: rsync-daemon</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:17481 https://cve.radiocsirt.org/vuln/bdu:2026-12850 bdu:2026-12850 https://cve.radiocsirt.org/vuln/bdu:2026-12850 https://cve.radiocsirt.org/vuln/bell-cve-2026-41035 <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> <p><strong>Affected:</strong> Alpaquita:23: rsync, Alpaquita:25: rsync, Alpaquita:stream: rsync</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-41035 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0781 certfr-2026-avi-0781 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0781 https://cve.radiocsirt.org/vuln/euvd-2026-363705 EUVD-2026-363705 https://cve.radiocsirt.org/vuln/euvd-2026-363705 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41035 <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.</p> <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41035 https://cve.radiocsirt.org/vuln/ghsa-m34r-4v3r-pp9v <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.</p> <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.</p> https://cve.radiocsirt.org/vuln/ghsa-m34r-4v3r-pp9v https://cve.radiocsirt.org/vuln/msrc_cve-2026-41035 msrc_CVE-2026-41035 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41035 https://cve.radiocsirt.org/vuln/oesa-2026-2150 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: rsync, openEuler:22.03-LTS-SP4: rsync, openEuler:24.03-LTS: rsync, openEuler:24.03-LTS-SP1: rsync, openEuler:24.03-LTS-SP3: rsync</p> <p>Rsync is an open source utility that provides fast incremental file transfer. It uses the &amp;amp;quot;rsync algorithm&amp;amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):</p> <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.(CVE-2026-41035)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: rsync, openEuler:22.03-LTS-SP4: rsync, openEuler:24.03-LTS: rsync, openEuler:24.03-LTS-SP1: rsync, openEuler:24.03-LTS-SP3: rsync</p> <p>Rsync is an open source utility that provides fast incremental file transfer. It uses the &amp;amp;quot;rsync algorithm&amp;amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand. Security Fix(es):</p> <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.(CVE-2026-41035)</p> https://cve.radiocsirt.org/vuln/oesa-2026-2150 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10775-1 <p>rsync-3.4.1-5.1 on GA media</p> <p>rsync-3.4.1-5.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10775-1 https://cve.radiocsirt.org/vuln/rhsa-2026:20601 <p>rsync: Rsync: Use-after-free vulnerability in extended attribute handling</p> <p>rsync: Rsync: Use-after-free vulnerability in extended attribute handling</p> https://cve.radiocsirt.org/vuln/rhsa-2026:20601 https://cve.radiocsirt.org/vuln/rlsa-2026:19152 <p><strong>Affected:</strong> Rocky Linux:10: rsync</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:10: rsync</p> <p>The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.</p> <p>Security Fix(es):</p> <p>* rsync: Rsync: Use-after-free vulnerability in extended attribute handling (CVE-2026-41035)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:19152 https://cve.radiocsirt.org/vuln/suse-su-2026:2002-1 <p>Security update for rsync</p> <p>Security update for rsync</p> https://cve.radiocsirt.org/vuln/suse-su-2026:2002-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41035 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:25.10: rsync, Ubuntu:26.04:LTS: rsync</p> <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rsync, Ubuntu:Pro:16.04:LTS: rsync, Ubuntu:Pro:18.04:LTS: rsync, Ubuntu:Pro:20.04:LTS: rsync, Ubuntu:22.04:LTS: rsync, Ubuntu:24.04:LTS: rsync, Ubuntu:25.10: rsync, Ubuntu:26.04:LTS: rsync</p> <p>In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41035 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1156 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rsync ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rsync ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1156