CVE-2026-41035: Use After Free
In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.4.1+ds1-5+deb13u2Fixed in 3.4.1+ds1-5+deb13u3Fixed in 3.4.3+ds1-2 - Configuration
Do not run rsync with -X (aka --xattrs) on vulnerable versions, since the vulnerability is triggered by receive_xattr when xattrs are enabled.
rsync --xattrs / -X = disable - Compensating control
If possible, restrict/avoid rsync receiver operation for non-Linux platforms and common vulnerable Linux configurations, as the receiver-side use-after-free is reachable when the victim runs rsync with -X (--xattrs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41035?
CVE-2026-41035 is classified as a high severity vulnerability due to its potential for exploitation leading to a use-after-free condition.
How do I fix CVE-2026-41035?
To mitigate CVE-2026-41035, ensure that you upgrade rsync to a version later than 3.4.1.
What is the impact of CVE-2026-41035?
CVE-2026-41035 can potentially allow an attacker to execute arbitrary code via a specially crafted xattr during an rsync operation.
Which versions of rsync are affected by CVE-2026-41035?
Rsync versions from 3.0.1 to 3.4.1 are affected by CVE-2026-41035.
Is CVE-2026-41035 present on non-Linux platforms?
CVE-2026-41035 is more widely vulnerable on Linux platforms, while the presence of the vulnerability on non-Linux platforms is limited.