Skip to content
OpenAdvisories
High RHSA-2026:20604 2 CVEs

Red Hat Security Advisory: rsync security update

Published May 26, 2026 · Updated Oct 10, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream rsync-daemon 0:3.2.3-19.el9_4.3
Red Hat · RHEL 9.4 EUS rhel_eus:9.4::baseos rsync 0:3.2.3-19.el9_4.3

Vulnerabilities 2

  • High 7.4
    CVE-2026-41035

    In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a recei…

    Samba rsync rsync rsync Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2025-10158

    Rsync: Out of bounds array access via negative index

    A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger t…

    rsync rsync rsync rsync Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2415637
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2458898
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20604.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-10158
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-10158
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-10158
  • article
    https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1
  • article
    https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f
  • report
    https://access.redhat.com/security/cve/CVE-2026-41035
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41035
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41035
  • article
    https://github.com/RsyncProject/rsync/issues/871
  • article
    https://github.com/RsyncProject/rsync/releases
  • article
    https://www.openwall.com/lists/oss-security/2026/04/16/2