How to fix CVE-2026-41035?

CVE-2026-41035

EUVD-2026-23215 HIGH

2026-04-16 mitre

GHSA-m34r-4v3r-pp9v

Information Disclosure

7.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 21:22 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 07:50 vuln.today

DescriptionNVD

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

AnalysisAI

Use-after-free in rsync 3.0.1-3.4.1 allows authenticated remote attackers to corrupt memory during xattr synchronization on the receiver side. Exploitation requires victim to run 'rsync -X' (extended attributes enabled). …

RemediationAI

Within 24 hours: Inventory all systems running rsync 3.0.1-3.4.1 and identify which have extended attributes (xattr) synchronization enabled or accessible to authenticated users. Within 7 days: Disable rsync extended attributes functionality ('rsync -X') where not operationally critical, restrict rsync access to trusted networks via firewall rules, and disable rsync service on systems where it is not required. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-41035 vulnerability details – vuln.today

Back