Red Hat Security Advisory: rsync security update

Fixed packages 2

Vulnerabilities 3

• High 7.4
  CVE-2026-41035

  In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a recei…

  Samba rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  Apr 16, 2026
• Medium 6.1
  CVE-2024-12086

  Rsync: rsync server leaks arbitrary client files

  A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Jan 14, 2025
• Medium 4.3
  CVE-2025-10158

  Rsync: Out of bounds array access via negative index

  A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger t…

  rsync rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  Nov 18, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2330577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2415637
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458898
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20603.json
• report
  https://access.redhat.com/security/cve/CVE-2024-12086
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-12086
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-12086
• article
  https://kb.cert.org/vuls/id/952657
• report
  https://access.redhat.com/security/cve/CVE-2025-10158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10158
• article
  https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1
• article
  https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f
• report
  https://access.redhat.com/security/cve/CVE-2026-41035
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41035
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41035
• article
  https://github.com/RsyncProject/rsync/issues/871
• article
  https://github.com/RsyncProject/rsync/releases
• article
  https://www.openwall.com/lists/oss-security/2026/04/16/2