CVE-2026-41035
EUVD-2026-2321516.04.2026, 07:16
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| samba | rsync | 3.0.1 ≤ 𝑥 ≤ 3.4.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:3.4.1-6.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:3.4.1-2.el10_0.2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | 0:3.0.6-12.el6_10.3 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:3.1.2-12.el7_9.3 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 0:3.1.3-25.el8_10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:3.1.3-12.el8_4.7 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:3.1.3-12.el8_4.7 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 0:3.1.3-14.el8_6.10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 0:3.1.3-14.el8_6.10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:3.1.3-20.el8_8.5 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:3.1.3-20.el8_8.5 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 0:3.2.5-7.el9_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | 0:3.2.3-9.el9_0.5 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:3.2.3-19.el9_2.3 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | 0:3.2.3-19.el9_4.3 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:3.2.5-3.el9_6.1 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | 413.92.202606160406-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | 414.92.202606231112-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | 415.92.202606030318-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | 416.94.202606051757-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | 417.94.202606250942-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 418.94.202606051320-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 4.19.9.6.202606031700-0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Discovery 2 | 1782166952 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rsync |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
- CWE-130 - Improper Handling of Length Parameter InconsistencyThe software parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
- CWE-805 - Buffer Access with Incorrect Length ValueThe software uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
References