Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS rsync may crash or expose data
published 5 months ago
Summary
The rsync tool on CentOS can mishandle certain file attributes, which might cause the program to stop working or reveal information unintentionally. This happens when the software processes extended attributes during a transfer. Updating rsync to the latest version from the CentOS repositories resolves the issue.
What to do
- Update centos rsync to version 3.1.2-12.0.1.el7_9.tuxcare.els8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:7 | centos | rsync |
< 3.1.2-12.0.1.el7_9.tuxcare.els8 Fix: upgrade to 3.1.2-12.0.1.el7_9.tuxcare.els8
|
Original advisory text
rsync: Fix of CVE-2026-41035
- CVE-2026-41035: fix use-after-free in receive_xattr() qsort by using post-filter xattr count
References
- https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780389337.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41035 Vendor Advisory
Timeline
Published4 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1780389337 · OSV
Track software like this
Free during beta