Red Hat Security AdvisoryRHSA-2026:20602
rsync security update
Released 2026-05-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.2) rsync-daemon-3.2.3-19.el9_2.3
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) rsync-3.2.3-19.el9_2.3
Fixes 2 records
Priority LOW 34
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00393 · Published 2026-04-16 · Fixed CWE-130
Priority LOW 20
A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00349 · Published 2025-11-18 · Partial fix CWE-129
