[ CVE-2026-119741 · Published 3 Nov 2026 ]
Vulnerability in RsyncProject rsync
CVSS 7.5
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
[ Fixes ]Fixes and patches
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-4324
Rsync: Vulnerability allows denial of service Translated from German
[ References ]References
- github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/h…Patch
- github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04Patch
- github.com/RsyncProject/rsync/pull/1132Issue TrackingPatch
- github.com/RsyncProject/rsync/releases/tag/v3.5.2
- www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-chec…Third Party Advisory