ALPINE-CVE-2026-41035
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-41035
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-41035.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-41035
- Upstream
- Published
- 2026-04-16T07:16:31Z
- Modified
- 2026-08-27T20:18:25Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
- References
Affected packages
Alpine:v3.20 / rsync
Package
- Name
- rsync
- Purl
- pkg:apk/alpine/rsync?arch=source
Alpine:v3.21 / rsync
Package
- Name
- rsync
- Purl
- pkg:apk/alpine/rsync?arch=source
Alpine:v3.22 / rsync
Package
- Name
- rsync
- Purl
- pkg:apk/alpine/rsync?arch=source
Alpine:v3.23 / rsync
Package
- Name
- rsync
- Purl
- pkg:apk/alpine/rsync?arch=source