Nixpkgs security tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: rsync

Found 1 matching suggestions

View:
Compact
Detailed
Published
Permalink CVE-2026-41035
7.4 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
updated an hour ago by @LeSuisse Activity log
  • Created automatic suggestion 11 hours ago
  • @LeSuisse ignored reference https://g… an hour ago
  • @LeSuisse ignored
    19 packages
    • grsync
    • rrsync
    • rsyncy
    • btrsync
    • parsync
    • librsync
    • diskrsync
    • openrsync
    • vdirsyncer
    • sqlite-rsync
    • yaziPlugins.rsync
    • python313Packages.btrsync
    • python314Packages.btrsync
    • python312Packages.sysrsync
    • python313Packages.sysrsync
    • python314Packages.sysrsync
    • python312Packages.vdirsyncer
    • python313Packages.vdirsyncer
    • python314Packages.vdirsyncer
    an hour ago
  • @LeSuisse accepted an hour ago
  • @LeSuisse published on GitHub an hour ago
In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted …

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

Affected products

rsync
  • =<3.4.1

Matching in nixpkgs

pkgs.rsync

Fast incremental file transfer utility

Ignored packages (19)

pkgs.grsync

Synchronize folders, files and make backups

pkgs.rrsync

Helper to run rsync-only environments from ssh-logins

pkgs.rsyncy

Progress bar wrapper for rsync

pkgs.btrsync

Btrfs replication made easy

  • nixos-unstable 0.3
    • nixpkgs-unstable 0.3
    • nixos-unstable-small 0.3

pkgs.parsync

Tool to parallel rsync-like pull sync over SSH

pkgs.librsync

Implementation of the rsync remote-delta algorithm

pkgs.diskrsync

Rsync for block devices and disk images

Package maintainers