Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-1146

NIXPKGS-2026-1146
published 1 month, 4 weeks ago
Permalink CVE-2026-41035
7.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 1 month, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 1 month, 4 weeks ago
  • @LeSuisse ignored
    19 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python312Packages.sysrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python312Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    1 month, 4 weeks ago
  • @LeSuisse accepted 1 month, 4 weeks ago
  • @LeSuisse published on GitHub 1 month, 4 weeks ago
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted …

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Affected products

rsync
  • =<3.4.1

Matching in nixpkgs

pkgs.rsync

Fast incremental file transfer utility

Ignored packages (19)

pkgs.grsync

Synchronize folders, files and make backups

pkgs.rrsync

Helper to run rsync-only environments from ssh-logins

pkgs.rsyncy

Progress bar wrapper for rsync

pkgs.btrsync

Btrfs replication made easy

  • nixos-unstable 0.3
    • nixpkgs-unstable 0.3
    • nixos-unstable-small 0.3

pkgs.parsync

Tool to parallel rsync-like pull sync over SSH

pkgs.librsync

Implementation of the rsync remote-delta algorithm

pkgs.diskrsync

Rsync for block devices and disk images

Package maintainers