Critical Use-After-Free Vulnerability in rsync Package
Summary
RLSA-2026:19152: Important: rsync security update. Affects rsync versions < 0:3.4.1-6.el10_2. Fixed in 0:3.4.1-6.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsync utility is a widely used tool for copying and synchronizing files both locally and over networks. It is known for its efficiency, as it only transfers the differences between files rather than the entire file, making it a preferred choice for mirroring and backup tasks. However, a recently identified vulnerability poses a significant security risk to users of rsync, particularly those using version 3.4.1-6.el10_2 or earlier.
Vulnerability Detail
The vulnerability, identified as CVE-2026-41035, is a use-after-free issue in the handling of extended attributes within the rsync utility. This flaw can be exploited by attackers to potentially execute arbitrary code or cause a denial of service, leading to unauthorized access to sensitive data or disruption of services. The vulnerability arises from improper memory management, where the program continues to reference freed memory, creating opportunities for exploitation.
How To Fix
Minimum fixed version
0:3.4.1-6.el10_2
This is the first release that contains the fix.
sudo dnf update rsyncTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, users can temporarily mitigate the risk by restricting access to the rsync utility or disabling its use until the update can be applied. This can be done by changing the permissions of the rsync binary:
sudo chmod 700 /usr/bin/rsync
This command restricts access to the rsync utility to only the root user.
Conclusion
The rsync utility has a critical vulnerability (CVE-2026-41035) that can lead to severe security risks. Users are strongly advised to update to the patched version to protect their systems. For those unable to update immediately, implementing temporary workarounds is recommended until the update can be applied.
See every vulnerability recorded for rsync →
FAQ
CVE-2026-41035 is a use-after-free vulnerability in the rsync utility that can lead to arbitrary code execution or denial of service.
You can check your version of rsync by running 'rsync --version' in the terminal. Versions prior to 0:3.4.1-6.el10_2 are vulnerable.
If you cannot update immediately, consider restricting access to the rsync utility or disabling its use until you can apply the patch.
More details can be found on the CVE page for CVE-2026-41035, which provides insights into the impact and technical specifics of the vulnerability.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json, providing real-time alerts without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for rsync.
