Red Hat Security Advisory

RHSA-2026:25149

rsync security update

Released 2026-06-11 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2026-29674 CVE-2026-41035 · GHSA-m34r-4v3r-pp9v

LOW 34

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00393 Published 2026-04-16 Fixed CWE-130