In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.

ELSA-2026-19152: rsync security update (IMPORTANT)

ELSA-2026-17481: rsync security update (IMPORTANT)

Security update for rsync

Security update for rsync

Security update for rsync

Security update for rsync

Security update for rsync

Security update for rsync

Множественные уязвимости rsync