Nixpkgs security tracker

Try the new UI
Login with GitHub

Details of issue NIXPKGS-2026-1146

NIXPKGS-2026-1146
published 5 months, 1 week ago
Permalink CVE-2026-41035
7.4 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Changed (C)
  • Confidentiality (C): Low (L)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Changed (C)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 5 months, 1 week ago by @LeSuisse Activity log
  • Created suggestion 5 months, 1 week ago
  • @LeSuisse ignored
    19 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python312Packages.sysrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python312Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    5 months, 1 week ago
  • @LeSuisse accepted 5 months, 1 week ago
  • @LeSuisse published on GitHub 5 months, 1 week ago
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted …

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Affected products

rsync
  • =<3.4.1

Matching in nixpkgs

pkgs.rsync

Fast incremental file transfer utility

  • nixos-unstable -
    • nixpkgs-unstable 3.4.1
    • nixos-unstable-small 3.4.1
Ignored packages (19)

pkgs.grsync

Synchronize folders, files and make backups

  • nixos-unstable -
    • nixpkgs-unstable 1.3.1
    • nixos-unstable-small 1.3.1

pkgs.rrsync

Helper to run rsync-only environments from ssh-logins

  • nixos-unstable -
    • nixpkgs-unstable 3.4.1
    • nixos-unstable-small 3.4.1

pkgs.rsyncy

Progress bar wrapper for rsync

  • nixos-unstable -
    • nixpkgs-unstable 2.2.0
    • nixos-unstable-small 2.2.0

pkgs.btrsync

Btrfs replication made easy

  • nixos-unstable -
    • nixpkgs-unstable 0.3
    • nixos-unstable-small 0.3

pkgs.parsync

Tool to parallel rsync-like pull sync over SSH

  • nixos-unstable -
    • nixpkgs-unstable 0.2.0
    • nixos-unstable-small 0.2.0

pkgs.librsync

Implementation of the rsync remote-delta algorithm

  • nixos-unstable -
    • nixpkgs-unstable 2.3.4
    • nixos-unstable-small 2.3.4

pkgs.diskrsync

Rsync for block devices and disk images

  • nixos-unstable -
    • nixpkgs-unstable 1.3.0
    • nixos-unstable-small 1.3.0

pkgs.vdirsyncer

Synchronize calendars and contacts

  • nixos-unstable -

pkgs.sqlite-rsync

Database remote-copy tool for SQLite

  • nixos-unstable -

Package maintainers