CVE-2026-41035

Description

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

PUBLISHED Reserved 2026-04-16 | Published 2026-04-16 | Updated 2026-04-22 | Assigner mitre

Problem types

CWE-130 Improper Handling of Length Parameter Inconsistency

Product status

References

www.openwall.com/lists/oss-security/2026/04/16/9

www.openwall.com/lists/oss-security/2026/04/22/3

www.openwall.com/lists/oss-security/2026/04/16/2

github.com/RsyncProject/rsync/releases

github.com/RsyncProject/rsync/issues/871

cve.org (CVE-2026-41035)

nvd.nist.gov (CVE-2026-41035)

Download JSON