Critical Security Update for rsync: Addressing Use-After-Free Vulnerability
Summary
ALSA-2026:19152: Important: rsync security update. Affects rsync versions < 3.4.1-6.el10_2. Fixed in 3.4.1-6.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and across networks. It is known for its efficiency, as it only transfers the differences between files instead of the entire files, making it a preferred choice for mirroring and backup tasks. However, a recently discovered vulnerability poses a significant risk to users of rsync, particularly in its handling of extended attributes.
Vulnerability Detail
The vulnerability identified as CVE-2026-41035 is a use-after-free issue in the extended attribute handling of the rsync utility. This flaw can potentially allow an attacker to exploit the memory management of the application, leading to unauthorized access or manipulation of data. The ramifications of this vulnerability could include data corruption, unauthorized file access, and even remote code execution, depending on the attack vector employed.
How To Fix
Minimum fixed version
3.4.1-6.el10_2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of rsync for sensitive operations until the update is applied. Additionally, consider disabling extended attributes if they are not necessary for your use case, although this may not be feasible for all users.
Conclusion
The rsync utility is essential for efficient file synchronization, but the recently discovered CVE-2026-41035 vulnerability poses serious risks. Users are strongly encouraged to update to the latest patched version to mitigate these risks and ensure the security of their data.
See every vulnerability recorded for rsync →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to memory corruption and exploitation.
You can check your rsync version by running 'rsync --version' in the terminal. If it is below 3.4.1-6.el10_2, it is vulnerable.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without any signup at the Vulert playground.
Failing to address this vulnerability could lead to unauthorized access to sensitive data, data corruption, or even remote code execution by malicious actors.
While waiting for the update, it is advisable to limit the use of rsync for critical operations and consider disabling extended attributes if possible.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
