The rsync utility, which facilitates fast file synchronization by sending only file differences, contains multiple security vulnerabilities affecting Red Hat Enterprise Linux 9.6 EUS and related products. The vulnerabilities include: (1) a server-side issue where arbitrary client files can be leaked (CVE-2024-12086), (2) an out-of-bounds array access triggered by a negative index (CVE-2025-10158), and (3) a use-after-free flaw in handling extended attributes (CVE-2026-41035). These issues could potentially lead to unauthorized data disclosure or memory corruption. Red Hat has released updated rsync packages addressing these vulnerabilities. The advisory references the Red Hat Security Advisory RHSA-2026:20603 for detailed patch information.

The vulnerabilities in rsync could allow an attacker to leak arbitrary client files from the rsync server, cause out-of-bounds memory access, or trigger use-after-free conditions, potentially leading to information disclosure or memory corruption. While no active exploits have been reported, the issues are rated as having an important security impact, indicating a significant risk if left unpatched.

Red Hat has released updated rsync packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed instructions and updated packages are available in the Red Hat Security Advisory RHSA-2026:20603 at https://access.redhat.com/errata/RHSA-2026:20603. No additional mitigation steps are indicated beyond applying the provided patches.